New technologies, old risks, IoT (in-)security

What is IoT?

Take these

put them into "normal" objects

and connect them to the Internet!

to make them smart!

Major Risks of IoT

• account hijack
• data/privacy abuse
• interception/surveillance
• rogue/“zombie” devices
• supply chain/SDLC compromise
• massive botnets (e.g. DDoS)
• physical attacks
• human casualty

some examples

Mirai botnet

Cayla the Doll

BIOTRONIK Cardiomessenger II

Hacking Yourself: Marie Moe and Pacemaker Security

Recommendations (user)

• strong password security
• software/firmware updates
• network segmentation and filtering
• physical security
• check contracts, terms and conditions
• ! if you don't need it don't use it !

!! If you don't need it don't use it !!

Recommendations (provider)

• security by design
• sound data collection/mgmt
• supply chain integrity
• check third party software
• comprehensive testing
• security by default
• sound patch policy and process
• comprehensive documentation
• leverage on standards and good practice

smart & secure

www.secure-iot.lu

Thank you for your attention! questions?