All right, let's take a look at Module
13, which deals with IoT and OT security.
First, we should probably define the difference between IoT and OT.
Iot is Internet of Things or Internet of Everything, sometimes called I OE, which
is basically anything with an IP address and the ability to process.
The more complete definition, network of
devices having IP addresses and the capability to sense, collect and send data
using embedded sensors, communication hardware and processors.
They're deployed for a wide variety of applications.
Typically, they're implanted on natural, human made or machine made objects and
have the functionality of communicating over the network.
That right there
is cause for concern, the ability of communicating over the network.
When you put another device on your
network, you're providing access potentially to your network.
Imagine that you install a Firm o dog
treat launcher, or Amazon Alexa, or a Nest front doorbell, or a refrigerator with an
internal camera, or a sleep number bed, etc.
Those devices are now possibly can be
compromised and used as pivot points on your network.
They may collect information, report it back to central authority, etc.
There's cause for concern because they are computers.
We don't think of them like that because
it's a gungy, cool device that improves my quality of life.
But at the same time, we're
possibly providing surveillance access inside our security parameters.
You should exercise a healthy concern.
There's also the concept of isolating the systems on an isolated network.
We'll talk about that a little bit.
But I got a couple of stories for you on IoT.
Now, don't get me wrong, love the Alexa,
love the Google Assistant, love the IP security and so forth.
But two situations that gave me pause and also freak my wife out a little bit.
But the first story is a friend of mine gave me a Firm o dog treat launcher.
This little camera pylon looking thing with a microphone, a camera, a little hole
in the front that you fire dog treats out of.
The whole purpose for this thing, so you could check on your dog during the day and
launch little treats and check in with them and see how they do it.
That's awesome. That's cool.
My dog will love the treat launcher for sure.
I get this thing set up and I train my dog
that those projectiles coming at him are actually a good thing.
They're food. Once he figured that out, he loved it.
The very freaked out by it initially, though.
The whole voice coming from it was a little bit weird.
Once he got used to it, it was awesome.
After we got him trained up on it, I left
it in the corner of the kitchen and forgot about it.
I wasn't out of the house, wasn't launching dog treats.
But a little bit later that evening, we're
sitting watching some TV and my phone goes off and it's an email from the furbo
people with the subject line highlights from your dog's day.
Isn't that a nice feature?
Highlights for my dog's day.
Not sure what I... Not sure I like that.
Let's see what this is about.
I click on the link, it starts playing the video and it's
random clips of our kitchen, random video surveillance.
Some my dog moving around, some not, some myself, my wife.
I'm showing her this and I watch her
brow get a little frowed or just get a little bit concerned.
She's like, Yeah, we're getting rid of that thing.
My wife is very security conscious.
Sometimes even more than I am and I do this stuff for a living.
She said, Yeah, absolutely not.
That thing's getting disconnected.
But what are the potential issues there?
It wasn't necessarily malicious.
It was meant to be fun and useful.
But at the same time, I installed an
internal video camera in my house with motion activated recording.
Probably not good.
If you think about it, though, the application security that goes around
that, you never know how much security planning has gone into that.
So if somebody had compromised my Firm o account online and had collected my
username and password from a Have I Been Pwned database or something like that,
they might be able to log in and remotely monitor my house.
So that thing got boxed back up and we haven't used it since.
Second story, and this one was creepy.
My wife swears up and down that what she
talks about at work shows up on her phone and so forth.
My explanation for all that is that the
whole predictive suggestion thing is way more accurate than you think.
You had to have mentioned it somewhere.
You had to have done a web search or something like that.
She swears up and down. No, no, no, no, no.
We're sitting one night, again, watching TV.
We're watching Men in Black International.
You got Chris Hemsworth, Thor from the Marvel movies.
Then you've got Liam Neeson. Loved Liam Neeson.
Watch any Liam Neeson movies.
One of my favorites.
We're sitting there and I mentioned to my wife, I'm like, How old is he now?
How old is Liam Neeson?
She's like, Yeah, I don't know.
Kind of wondered about it.
She gets to talk and there's a scene where they're both standing side by side.
He was like, Taller than Chris Hemsworth.
She's like, My gosh, he must be tall
because I know Chris Hemsworth is like, you know, over 6 feet.
I wonder how tall he is.
I go, I'm like, Yeah, he definitely looks tall.
I always get these out of order here.
But I'm like, Man, I wonder how old he is.
Alexa, how old is Liam Neeson?
Liam Neeson is 74 years old. Got it.
Would you also like to know how tall he is?
We both look at each other like, We didn't ask that.
We're really sure she was listening before
we actually sent the voice prompt, but it was really creepy.
I don't think it's really a plausible explanation for that.
But just for the record, Chris Hemsworth is 6'3, Liam Neeson is 6'4.
He actually has an inch on Chris
Hemsworth, and he's currently 74 years old.
But she offered up some stuff that we had
just been talking about that there's no way she could have known.
What are they collecting?
What are they surveilling?
Again, healthy caution, especially with cameras and things like that.
I've got no cameras that are left uncapped.
I've got caps on a laptop, things like that.
There's some duct tape over the top of it because I've just seen way too many
compromise systems that the first thing they do is turn on video camera access.
Couple of stories around IoT.
I'm getting ready to put in some home
automation stuff and I'm going to be hardwired and everything.
I'm just going to say that right now.
I said in the last module, big proponent of hard cabling, especially for security
systems, things like that, because a signal jammer could pretty easily knock
out your entire network, depending on the right frequency.
I'm digressing a little bit here.
That's a bunch of dialog for just the opening slide.
Let's dig into it.
One more.
Years ago, there used to be this movie called Warriors of the Net.
It was a graphical representation of IP, TCIP, and how that works.
It was based on space trucking.
I remember at the end of that thing, and
this was 20 years ago, end of that thing, they're saying, Who knows?
Maybe your refrigerator will have a camera where you can see if you've got the
makings for a chicken c atatory while you're at the supermarket.
I remember thinking very vividly thinking
to myself, Wow, yeah, I don't think we're ever going to get there.
We're there. You got refrigerators and have cameras.
You've got all of these IP enabled devices
that can communicate with hand held apps and so forth.
Again, we're in a revolution of AI and IoT and so forth, but we need to really,
really think through the security of all this just to be on the safe side.
I'm going to jump off my soapbox now, but
industrial devices, health care devices, home devices, wearable devices, health
care devices, insulin pumps, pace makers, little computers that could be hacked.
Again, gives you a pot.
Have a healthy skepticism or healthy fear.
What am I looking for it here.
Have a healthy concern for the security of these devices before you just default
configuration deployment to your home networks or your business networks.
While organizations are opting for IoT
devices, i nenvironments, IoT devices work on a three dimensional plane, offering
connectivity for anyone, anytime, for anything from any place.
So outdoors, indoors, daytime, night
between PCs, human to human, human to things, everything keeps an IP address.
And we've got a heck of a connectivity network in the form of the Internet
and an addressing scheme that accommodates all those.
So yeah, there's a lot of advantages to it, no doubt about it.
Iot applicationers and devices.
This is one of two slides in your course where to list out the different service
sectors, the locations, and the devices being used.
The HVAC, one more quick story for you.
We used to use in one of the clients I
work with used to have a training center location in Panama City.
In Panama City, it was a room rental.
They were leasing it for a while.
But the way we adjusted the thermostat there was through a Honeywell app.
It's Honeywell thermostat.
It did everything through a web interface.
That was three and a half years ago, and that facility was actually
partially destroyed during the Hurricane a while back and was rebuilt.
But I still have remote access to that Honeywell thermostat.
Again, all the applications and a lot of stuff is web application based.
You have to consider the security for all this.
Last one, remember that nanny cam a few years back where that
creep had hacked in and was talking to the kids saying it was Santa Claus?
Creepy. Healthy, respected.
That's the last example I give up.
I'm going to give promise.
Buildings, energy, consumer at home,
health care and life science, transportation.
I do have a friend who's not a test mechanic, but he teaches.
He's a master GM mechanic of the highest level.
But he's also a college instructor.
He was doing a class on Teslas with a huge nondisclosure agreement attached to it.
He said, You would not believe what that thing can monitor.
I do believe it. All right.
So vehicles, again, anything computer
controlled, if you can talk to it, you can hack it.
Always keep that in mind and you'll have the right mindset, but you should question
everything and if I could talk to it, I can hack it.
Iot technologies and protocols, and that's the CEH in me talking.
Short range wireless communications,
medium range wireless communications, long range.
We have some different technologies
for interoperability between IoTs and protocols.
A lot of this stuff, again, uses conventional Ethernet 802.11 and TCPIP.
The wired communication, Ethernet,
Multimedia over CoAx, power line communication.
Power line communication is we're sending
signaling through existing power line infrastructure.
Then some of your IoT operating systems.
Okay, Windows IoT, Amazon FreeRTOS, Contiki Fusha, Name of Few, RIOT.
Some of your application protocols, CoAP, Edge, physical web, XMPP.
The IoT architecture.
You may have direct access to the IT device.
It may access through a gateway.
Depending on how you've got the tiers set
up, the gateway is responsible for collecting data from devices and
performing preliminary processing the data before sending the cloud.
This could be a multi layered scenario or architecture.
One example is an IoT gateway.
Just the layers of the IoT architecture.
We're not going to pick this apart too much right now, but the device layer,
the communication layer, the cloud platform layer, and the process layer.
Again, these are the different tiers of communications between the processing and
if it is using a cloud app, you'll send it to the cloud platform.
But that's a bunch of middleware components for staging between the
devices, ultimately the data being processed.
The device to device model is direct connectivity.
Light bulb, for example, across the wireless network to the light switch.
Typically, there's some a hub being used.
I've got exactly one light bulb in one closet and I can control it through Alexa.
I haven't really gotten into much more of that.
But at some point, I might expand on that a little bit.
But the device to cloud model, device to
the temperature sensor, connects to an application service provider.
Device with a carbon monoxide sensor, again, connects to the cloud.
Again, that's more of a centralization.
The devices to gateways.
The devices, again, send to the gateways up to the application service provider.
Then you have cloud to cloud communications as well or a back end data
sharing model if you are actually sharing data between two cloud providers.
Again, from a deployment perspective, the
only thing I've ever deployed is what I've been talking about at home.
I haven't really gotten into any production environments.
I've done security testing on them, but no deployments.