Securing the Connected Home – Noopur Davis, Comcast

This is texturing TV. Hey guys. Thanks to the throw.

We're here with Newport Davis who's Executive Vice President Chief Information Security and product officer for Comcast cable. And we're talking about the connected home and security and what are some of the challenges we're running into these days Newport. Welcome to the show.

Thank you for having me. The connected home is now essentially an extension of the office and large numbers of people are still working from home. Even this far after the alleged end of the covid-19 pandemic.

What have we learned so far about some of those Trends and challenges that security people are encountering to help keep that extended Enterprises. We know it today secure. Yeah, it's not just people working from home, but they're still you know doing school from home and all kinds of other things.

So our second cyber report that our first one was done two years ago in that time in the two years. We've seen a 25% increase in the connected devices in our customers' homes, so The security of those devices is important. Anything that is connected to a Comcast Gateway is protected.

So anything in that Wi-Fi network in the home is protected. And so you can kind of live your digital life a little more safely and feel a little more secure whether you're you know, doing your work from those digital devices or just playing a video game or you know, if it's some iot device that is just, you know operating in the background. Do you see people separating the networks that they use at home from the ones that they use to connect to the office or are they using the same core Network and therefore a lot of the behaviors that we might see or risky shall we say?

So yes, and no we see some separating out, you know in a separate VLAN or some other way, but most offices do have you know, a VPN or some other secure a tunnel to connect from your home to the office. They're also more and more secure devices. So, you know, there's businesses are making sure that the device that you connect into their network is also secure.

So if you have a secure connection and a secure device, you know with multi-factor authentication and all types of other identity controls you do reduce that risk. Are you also seeing people be more mobile? So they're accessing services not just from home.

But you know, they're going down the coffee shop. They're kind of going to their vacation homes or wherever they be or visiting relatives. So yeah, is that part of the security conversation because it's not like I log in every day from the same place.

Absolutely, you know this is where there's a whole movement around something called zero trust network access and it basically says look you really can't trust the network from from that point of view. Right? So if I'm in a coffee shop, and I'm using a open network, how do I still make sure that I can connect securely so that it a whole new set of controls are being put into place for that zero trust network access.

Who manages all of this because it seems to me that most it teams are shorthanded to begin with and managing all this stuff at home seems fairly hard. So are they just relying more and more on some sort of service from you guys to kind of take care of all this warm? Yes, you know if you're in your home, it is very very difficult for most people to even realize that they have that many connected devices which are you know talking to who knows who right on the on the internet.

So it is really really important to have that almost like the safety net that is there to just protect you and that is why that Comcast Xfinity Advanced security product which is, you know free for anybody who uses our Gateway just protects you from any device that connects to the Wi-Fi that is connected through that Gateway. So it really does make a difference. I I use it in my own home.

I'm a Comcast customer as well as an employee and you know it will I will just see a little thing pop up that you know, my son may have gone somewhere where it's not safe. So it just that that level of safety and alerting really really does help you. Are you seeing more of the bad guys targeting people working at home or they scanning and looking for those folks because they determine that maybe they are more vulnerable and then that becomes the entry point to the rest of the Enterprise Network.

We don't have any specific data around that but the overall number of tracks is definitely increasing. So our Xfinity XY Advanced security product has blocked 10 billion threats in the five years that it has been running and that Trend per year keeps going up. So the number of average number of threats that we block is average number of unique threats that we block is 23 per month per household.

The actual number is probably several times that because a unique threat doesn't happen. Just once you know, it's it is executed multiple times. And a lot of times we have devices that are connected to that home network that are not just my laptop that I'm using for work.

There's all kinds of stuff connected and each of those things has a different security profile. So is that something else that you guys will manage because somebody might attack some device or a printer or whatever it may be and then try to laterally move that now we're through so how extensive are your efforts to connect everything that is on that whole network. We don't discriminate so anything that is connected to that home network, you know, there are two types of controls one is incoming.

So, you know, is there something coming in to you know from a malicious IP or you know a known bad reputation site that is trying to connect to Something in the home. So we we do monitor that and block that and then the same outgoing. So if for example your device has become part of a botnet or it is trying to access a malicious site.

We also block that so both of those So getting your crystal ball out for the new year as we kind of look at what's coming down the pike. What do you think is gonna be and the current state of the art for securing connected homes. And what do you expect to see happen in the coming year will everything gets smarter and if so, how Yeah, I think the trend is going to just that number, you know that 25% increase we saw in two years.

I think that's actually going to accelerate so, you know everything from Smart light bulbs to all of the things that we already but you know, like come baby swings that are connected to the network and you know, your your laundry machine that orders replacement detergent when it runs out, right? So everything is is gonna get more connected. I think there are standards emerging which which we are, you know integral part of defining those standards is how do we make sure that iot devices are secure and by iot defies this I just mean Internet of Things.

And everything from you know default passwords to making sure that they are updatable over the wire. So when a vulnerability is discovered that they can be patched. So that is really important as the device is keep increasing.

I think we are going to see emerging standards and Consumers becoming more smart about hey, this device complies to a standard and this device doesn't and hopefully buying the devices that comply to standards. And what's your best advice to the it folks that are looking at all this stuff because they have all these employees working from home. How do they know what the level of security is gonna be in you know, do they need to personally check that or do they just get a report from you guys?

How do I know that my employees Network at home is secure enough and trustworthy enough. So that is you know, something that the IT team would have to do for that particular employer, but it's really three fundamental things, you know is the identity secure of the person who's trying to get in so, you know the identity of the person and that is usually confirmed through some kind of multi-factor authentication and should be then second is is the device that they're connecting to through secure so that is you know, either through some device Identity or making sure that the device has you know, anti-malware EDR all kinds of other and then the third is What are the network controls if any now if you can't control the network then you also may have to look at the application Level controls. But so just to summarize the person identity the device identity and health.

the network Health and then the application health and you have to look at all for All right last question, you mentioned zero trust in a lot of people have it in their head that this is hard to do and that I'm gonna get all this layer defense and all these products but more I talk to you at the question whether or not I can just get zero trust as a service and if I have it applied to the the machine and the user and the application. I'm in pretty good shape. Yeah, it sounds easy.

But it's as You guys end right? Devices are complex as you just said people don't just access through your you know, it's tablets. It's laptops.

It's mobile phones. It's all types of devices identities are complex and applications are complex and you put all three of them into a ecosystem and that's what Zeo trust has to manage. But yes, the promise of zero trust I think is is really great because what it what it really does is say at any given time.

Any given moment in time, how can I look at that entire ecosystem and determine what the risk is to allow a person through a device to connect to a corporate resource? All right, great Newburgh. Thanks for being in the show.

Of course happy to be here. All right, folks, you're heard it here just because you can do something yourself doesn't mean you should because there's lots of other things you could probably do that add more value. Hey guys.

Thanks for watching.