Transcription

IoT Security and privacy challengesAdel Abdel Moneim, MBAITU-ARCC Cyber Security ExpertSCCISP ,CISSP, CISM, CRISC, CISA, CGEIT, CCISO,SABSA-SCF, CEH, CCSK,CHFI, EDRP,CSA ,ECSA, LPT,CND, ECES, CCFP-EU,PECB MS Auditor, SMSP,ECIH, Master ISO27001, ISO27005LRM , ISO31000, ISO27032 Lead Cybersecurity Manager, ISO27035 LIM, ISO38500 Lead IT CorporateGovernance Manager,ISO24762 LDRM, CLSSP, ISO 29100 Lead Privacy Implementer, Lead Forensic Examiner, Certified Cyber IntelligenceProfessional (CCIP)

Definition of IoT[WIKIPEDIA ] The Internet of Things (IoT) is thenetwork of physical objects or "things" embedded withelectronics, software, sensorsand connectivity to enable it to achieve greater valueand service by exchanging data with the manufacturer,operator and/or other connected devices.[ OXFORD ] A proposed development of the Internet inwhich everyday objects have network connectivity,allowing them to send and receive data.

The internet of Things moves in

IOT Attack newsADEL ABDEL MONEIM [ [email protected] ]4

IOT Attack ttacks-cost-the-uk-economy-1-billion/5

IOT Attack news6

IOT Attack news7

IOT Attack news8

IOT Attack news9

10

Smart Home &Wearable devices

IoT in Health

IoTin Agriculture

IoTin Education

IoTin Traffic

IoT in Retail

IoT in Smart City

IoTBasedWasteCollection

IoT Based Pollution Control

Smart Dust Bin in London

Smart Dust Bin in London (Cont.)

Smart Dust Bin in London (Cont.)

IoT Application Areas and Devices

IoT Application Areas and Devices

IoTAttackSurfaceAreasDevice Memory Cleartextcredentials Third-partycredentials Encryption keysEcosystem(general)Device PhysicalInterfaces Implicit trustbetweencomponents Enrollmentsecurity Decommissioningsystem Lost accessprocedures Firmwareextraction User CLI Admin CLI Privilegeescalation Reset to insecurestate Removal ofstorage media TamperresistanceDevice WebInterface SQL injection Cross-sitescripting Cross-siteRequest Forgery Usernameenumeration Weak passwords Account lockout Known defaultcredentialsDevice Firmware Hardcodedcredentials Encryption keys Encryption(Symmetric,Asymmetric) Sensitiveinformation Sensitive URLdisclosure Firmware versiondisplay and/orlast update date

IoTAttackSurfaceAreasDevice NetworkServicesAdministrativeInterface Informationdisclosure User CLI Administrative CLI Injection and Denialof Service UnencryptedServices Poorly implementedencryption UPnP Vulnerable UDPServices SQL injection Cross-site scripting Security/encryptionoptions Logging options Two-factorauthentication Inability to wipedeviceLocal DataStorageCloud WebInterfaceThird-partyBackend APIs Unencrypted data Data encrypted withdiscovered keys Lack of data integritychecks SQL injection Cross-site scripting Transport encryption Insecure passwordrecovery mechanism Two-factorauthentication Unencrypted PII sent Encrypted PII sent Device informationleaked Location leaked

ionVendor BackendAPIsEcosystemCommunication Update is notencrypted Updates notsigned Update locationwritable Updateverification &authentication Missing updatemechanism No manualupdatemechanism Implicitlytrusted bydevice or cloud Usernameenumeration Account lockout Known defaultcredentials Weak pass Transportencryption Insecurerecoverymechanism Inherent trustof cloud ormobileapplication Weakauthentication Weak accesscontrols Injection attacks Hidden services Health checks Heartbeats Ecosystemcommands Deprovisioning Pushing updatesNetwork Traffic LAN LAN to Internet Short range Non-standard

IoT Security is the T services, encryption, firewall, input authN, authZ, input validation, etc. insecure APIs, lack of encryption, etc. AuthSessionAccess net app mobile cloud IoT

IoT Technologies and Protocols

IoT Communication Models

IoT : How IoT Works

Data Leakage & Users Privacy Issues

Data Leakage & Users Privacy Issues

Data Leakage & Users Privacy Issues

Google Services

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Google Services (Cont.)

Samsung Health App

Samsung Health App

Samsung Health App (Cont.)

Samsung Health App (Cont.)

Samsung Health App (Cont.)

NIST Cyber Security Framework

56

Contact eim

Questions?