Cybersecurity and the Internet of Things | Security Boulevard Ep. 2

Today, we, the consumer, are the enterprise. And, and so how do we protect us going forward? Welcome to Security Boulevard, the cybersecurity podcast from the Futurum Group.

Every episode explores a variety of topics within cybersecurity and the technologies that drive it. com on our Security Boulevard, YouTube channel, tech Strong tv, and all of your favorite podcast platforms. Before we jump into the episode, let's meet today's panel, starting with my friend Fernando.

Hey, Fernando, how's it going this week? I'm, I'm doing well, thank you. I'm experimenting with different video things here.

So, hello everybody. Fernando Montenegro. I'm VP and Practice lead for cybersecurity here at the Futurum Group.

Right. And, um, we, we cover different security topics as one might expect, right? This one is really interesting.

The one we have for today is really interesting, and I can't wait to get started. Uh, on that, I'll pass it over to Kate, Right? Hi, my name is Kate Scar.

I'm the chair of the CD Cybersecurity sig, also, um, cybersecurity Architect and C-I-S-S-P. My focus is securing the full stack from pipelines to networks to emerging AI and LLM ecosystems to make innovation not just faster, but safer. Alright?

And of course, I'm Tom Hollingsworth. I'm the event lead for Security Field Day and other security related events at Tech Field Day, and that's part of the Futurum group, uh, just like Fernando and I, and I'm very happy to have Kate joining us today because it's, uh, gonna line up to be an amazing day, but it's not the most amazing thing because folks buckle up. It is officially National Taco Day, and how did it just so happen that it fell on a Tuesday?

However, don't say the word taco next to the word Tuesday, because evidently there's a trademark that you have to worry about there. So no, no, no, no, no, no. This just happens to be a Tuesday that includes tacos.

That's not your thing, though. It's also a national chocolate covered pretzel day. But maybe you could have both, you know, little, little meal, little dessert, uh, you know, but the little things in life, that's what really makes it worthwhile.

And we wanna talk about the little things today, because this episode is gonna be all about the internet of things. You know, those little devices that seem to have completely taken over our lives. Uh, I, I know this for a fact because last night, uh, my wife was absolutely insistent that the heater must have kicked on at two 30 in the morning.

And so I grabbed my phone and I pulled it up, and I looked down there, and I'm like, no, actually, the heat's not on. Um, we need to investigate some other things that might be going on. Uh, but in the old days, you know, I would've had to get up.

I would've had to walk downstairs. I would've had to like, get it put on my glasses and flick on a light and tap the thermostat. So obviously, iot has made my life significantly easier until someone figures out how to get a, my thermostat and actually do turn on the heater when it's 90 degrees outside, because that's a thing we've heard about.

And that's on the consumer side of things. We're not talking about industrial milling machines and all of the other ridiculousness. So for this episode of Security Boulevard, it's all about IOT.

Kate, you're the one that really brought up this topic, so I wanted to give you a chance to kind of open up it for some of the things that you've seen out there. What is it about IOT and the intersection with security that kind of makes you lay awake at night, even if the heater's not on? Right?

So it's basically how devices have just taken over our lives more so than we realize. Um, last time I really, there's over 44 billion iot devices, and to me, it's, you know, it's just like the tsunami of devices that we have, zero, almost zero cybersecurity, um, controls of, right? Because they're so small, they're so little, and they're very, very chatty.

So even if we try, have tried to bring them into, um, a security operation center into a soc, they can quickly overwhelm, um, SOC analysts because of the noise. And yet they're running, they're literally running our lives. So it's not just, um, the industrial internet of things, right?

We're not just talking about in critical infrastructure, the, the programmable logic controllers and the remote terminal terminal units, the RTUs and, and the PLCs. And, and I'm not, you know, I don't wanna get so deep into critical infrastructure, but, you know, there is this segue into the internet of things and how it connects and, and things that we don't even think about, like HVACs, you know, that's iot. Um, you know, our, our solar panels iot, and now when we think about, um, buildings and critical infrastructure and this bidirectional traffic of, um, of energy, and we're, we're not even monitoring these things.

And, and I did, um, I did a, uh, uh, like a proof of concept as I went down this path and looking at, you know, um, windmills and, and, and solar panels as an, as an example, and I am without exaggeration. Um, we put, um, we put a solar panel, like on the outside of the DMZ, and it was taken over within four and a half minutes and added to the Mariah, Mariah botnet, so the king of botnets it. And, and, and we couldn't even like, have access, meaning we actually had to send someone into the field and, and flash the, the solar panel to, to bring it back in.

Like, like it, they, they totally took it over this one solar panel. And one of the things that I thought about is the idea is that we would not have known that the solar panel was taken over because it was acting as it should have until when, until until we really needed it, right? I mean, and I, and I really started to think about how many of these devices, um, from cameras, from our, from, from our, our traffic lights to signs on the internet to, um, to, to building access controls.

I mean, think about just even, um, you know, parking meters today and, um, electric vehicle charging stations. These are all iot devices that we have zero zero visibility. So what do we do?

And, and, and when I really, and I don't know why I was thinking about this weekend, so talking about, you know, weekend things that, you know, we were thinking, you know, we've all been thinking about and having to deal with, but I was thinking really about our homes and how our homes have become these, you know, these small little business centers, not only from our printers, but from, you know, from the thermostat controls to our, um, to our fridge and freezer, or to, you know, so I can just keep going on. And all of a sudden now, we as a consumer have to be concerned about this, you know, have to be concerned about things that we typically thought was just business related, was just enterprise related. But today, we, the consumer are the enterprise.

And, and so how do we protect us going forward, our, our pacemakers? Um, I don't have one, but if I did have one, it would be right here. Um, so our, you know, these devices, all of a sudden we've also become these walking IO OT devices, uh, from our watches to our phones, to, you know, I used to have these smart glasses that were a blast to play with.

Um, but yeah, Fernando, I mean, how's your perspective on this from, from the research side? Because I know that I, I, we hear a lot about iot, but is anybody really doing a lot of investigating into just how insecure it is? Short answer is yes, right?

But let me, like, there is so much for us to, to, to, like, I, I, I really excited about the topic you all. Um, uh, you may have, you may remember the Mark Andreesen, uh, the guy who was, he was one of the leads with Netscape, uh, sorry, Netscape navigator way back when, and now he's, he, for, for years now, he's been a venture capitalist in, uh, Andreesen Horowitz. And back in 2011, I believe it's, he coined, he said he wrote a paper and he said something like, software is eating the world, right?

I say that because it's a, it's a quote that I use in some of my research for good reason, right? And yes, software has eaten the world, but software has eaten the world in, in two ways, right? In, uh, uh, within businesses.

It's because everything, I mean, technology drives everything, right? And, but what I, when I, when I think about IO ot, I think about IO OT as the physical representation of that, right? Software has eaten the world, and the vehicle through which software has eaten the world outside of data centers has been through IOT, uh, industrial control systems, uh, uh, scada take a pick on the, on the on, on the different things, right?

So it has really taken the world and random thought, right? As, as, um, uh, nothing to do with, uh, I think it's this coming Friday that, uh, there's a new, uh, uh, Tron movie coming out for those that, like the original, uh, trans of Tron Aries is coming out and have, from what I understand, has something to do with them coming into the real world. So as we were thinking about this, like, okay, there's, there's, there's an iot reference there somewhere.

But, um, but for us, uh, yes, it's, it's, it's an area that's deeply interesting. It's an area that, uh, plays a lot where, uh, if you, if you heard me say this, uh, a few times, but I always talk about, I always like to think about the economics of things. My degree is computer science, but if I ever go back to school, it'll be something around those lines of economics, organizational psychology, what have you.

And from an economics perspective, right? Iot introduces several really interesting problems for us, right? So, Kate, you are talking about the, the, the, the consumer side.

Well, how informed is the consumer about what they need to do with their, uh, consumer level IOT devices, right? That problem of information of how informed the consumer is, is at the heart of information as symmetry, right? Which is a, uh, an area of economics that I think was the Nobel Prize in 2000.

I think, uh, George Kerl and, and others, that that's the, they did some research on market for lemons, right? The, the, the, the concept of market for lemons. So it's screaming at us that this is an area of economic, uh, uh, where, where economic concepts play a part, and we've seen some initiatives over time.

Uh, there is, uh, I don't know where we are now from a regulatory perspective, uh, but there have been initiatives around consumer labeling of divisive, Hey, but we've never really took off. And that consumer labeling is interesting, but it doesn't mean anything if the consumer is not informed, right? So if me as a consumer buy an, I buy a device, right?

And, and for, uh, for this podcast, I, I, I bought a new camera, right? Uh, if I'm not aware of what the ramifications are, am I exposing myself? And, and the thing that that comes to mind, I mean, there are so many ILT related, uh, incidents we had over time.

You of course brought up the, the, the Mirai botnet, right? Um, the one that that struck me was, you know, how, uh, a few years ago we had issues with, um, uh, classified information being disclosed because, uh, soldiers were using their fitness trackers in sensitive locations, and they didn't know that that thing was being uploaded. Yeah.

Right? So the, the, the, the ramifications are, uh, uh, literally worldwide there, I say galactic, right? In the area we have iot, uh, outsiders.

Yeah. I love it. Yeah, absolutely.

Anyway, long and short of it, super interesting. Uh, but there, and, and, and I, I urge people to think about them, not only from a technology angle, but what is the economic foundation of IO ot? And I, I have more to talk about that, but I don't want to hog the mic too much.

I, I'm glad you brought up economics, because I feel like the drive for IOT is all about the modern enterprise of brutal efficiency. Like, like when you think about all of the things that we've been driving towards in, in, in the enterprise, especially around IT iot, and it, it is about making things as efficient as possible. But in order to know exactly how efficient it is, I have to be able to measure it and, and think about all of the things that a consumer iot gives you.

It gives you flexibility, right? I can set my thermostat from my desk, I can set my oven to preheat my lunch so that it'll notify me when I'm ready, so I don't have to keep going in there to see if it's ready yet. Um, you know, crazy things, like my fridge knows where the milk is, so it knows when the milk's getting low, so it can pre place an order for that.

That is all about making me more efficient as a person. But in the enterprise, it's about being able to measure, like think about a milling machine, right? If that milling machine is down for any amount of time, that's a literal cost to the business.

By monitoring that system, I can tell you how long it was down. But not only that, I can tell you when it runs most efficiently, how many people are necessary to be able to remove the work and to, to, to preload it for other things, which means I can keep a better cost on my staffing and, and so on and so on and so on. Where the intersection with security becomes a problem is one of my favorite topics.

Friction. We want a certain amount of friction in security so that it's visible. Think about the airport.

Realistically speaking, most of the stuff that they do at the airport for security can very easily be automated, right? And we've seen that in other airports all over the world, right? You just walk in, drop your stuff in a thing, walk through, and, and it's easy.

The reason why they have to wave you through, the reason why they have to w you or, or do a scan, is because they want you to see that there's something going on. But when you're doing that with iot, IOT's supposed to be invisible. So if you create friction that says, oh, well, you know, this needs to be authenticated, or the certificates on these devices need to be re um, renewed every two years, every point of friction for a thousand sensors for 10,000 sensors creates problems, and people are gonna chuck 'em out the window.

And Kate, to your point about the solar panel, the reason why the Mariah botnet has been so efficient is because it's invisible. If we had done this, if we had taken over all of these cameras and routers and things like that, and then made them unavailable, uh, the relative inexpensive of that chip set means that people would've just grabbed it and threw it out and got a new one. Whereas, you know, you can't do that with a $4 million paper press.

Like, you've gotta figure out how to fix that. And that's getting into the other problem that IOT is exposing is that a lot of the ways that people are choosing to put these things on the internet, so to speak, with IOT, is standardizing things that historically have not been standard. Like I can remember, there's an, there's an apocryphal story about a guy who gets hired to fix a pipeline, and he walks out and he taps a couple spots with a hammer, and then he sends a bill for $10,000, and the guy's like, I refuse to pay it.

That should not be too difficult. And he goes, oh, well, I'm only charging you a thousand dollars for tapping it with a hammer. I'm charging you 9,000, because I knew exactly where to hit it with the hammer.

Like those people who were good at programming SCADA systems, who are good at programming all those programmable logic controllers, they're still necessary to do that, but the infrastructure that they overlay that rides on top of that is pretty standard, right? It's HTTP, it is using rest APIs and things like that, which is real fun for people who know how to exploit those things. It's like, oh, you forgot to use a certificate on that.

I'm gonna have a field day. So like, is, is our drive for efficiency in the business creating these problems because, well, if I have to make sure that I can monitor everything so that I can automate it or use AI to collect statistics from it, am I just creating a trap for myself where everything becomes real easy to kayak? Yes.

I think, you know, it, it's a, it's one of the biggest problems, right? That, that we continue to see with iot because there's so many devices and, you know, how do we, how do we, we've already moved forward. So it's almost like everything else, um, when we look at, when I look at LLMs and things like, like, like the, it's already out of the, you know, the, the bull's already out of the, out of the cage, and it's running around the, the ring there.

Um, so it is a really big huge problem that I, I, you, you asked me at the beginning, like, what keeps me up at night? This is actually something that keeps me up at night because of all the systems that we have running on this. Now, when I, when I start to think about like, well, how, how do we start to capture this and, and bring this in?

And one of the things that I had wondered and, and it crosses, you know, like a business section is predictive analytics. So do we go from, instead of looking at, um, configuration and changes in configuration, which has been very problematic, even with just computers and servers and mainframes, um, but do we start to look at the behavior of the devices? And can we, by looking at the behavior of device, understand that it has been taken over.

And so that's how I, I have started to formulate, like, if I'm going to be looking at how to, um, take hold of, of this problem. And so let's just take a camera. This, this would be a really easy example.

Um, so let's take, let's say we have a thousand cameras in a large building, and typically, um, we understand that cameras are gonna start working, let's say it's 7:00 AM to midnight. And so they're gonna be very, very chatty. And so, but so, so that becomes our window of chattiness.

And, but all of a sudden, this camera that is usually not on, starts to come on at 3:00 AM. So I am going to look at that as an anomaly, and I'm gonna say, okay, now is it coming on? Because it's, it's dying.

You know, the, the device is, is suddenly, you know, I'm not feeling well, and I'm coming on, I'm coming off, I'm coming on, I'm, you know, or has it come out at 3:00 AM because there's anomalous activity happening in the, in the building. And so then we start to marry the predictive part of iot, which I think is important. But, but personally, um, to answer your question, I, I mean, I, I think we have to start looking at the behavior, um, from a cybersecurity point of view.

And, um, in order to start to wrap our arms around this problem of, of, because I don't, I don't know how else we can do it from a configuration standpoint, endpoint. It, it just is. So if we have 44 billion devices, how, how do we start this?

How do we, how do we secure this? I, it's a really big problem. It is, uh, it is a very hard problem, and I use the word hard on, in on very specifically on purpose.

There is a phenomenal study that came out of the national academ, so National AC Academy of Science, but National Academies overall, uh, called the cyber heart problems, right? These are, this is a research report that aims at, um, informing policy conversations, right? We wrote about it in, uh, back in June, I believe.

So the report came out in April, may timeframe. I wrote about it in June. And, uh, it's really interesting because they talk about what are the, the, the kind of cyber hard problems that we have to deal with as an industry, right?

Because, uh, they are not in intractable, but they are difficult to solve, and it's uncanny how many of them apply to IO ot? So we have a software composition problem, right? We, we, we are now not writing software anymore as much as we are assembling software, right?

Uh, uh, we're, there is a phenomenal problem with, uh, uh, how do we define the trust of a system, right? How do we evaluate trust, right? That's a, that's a hard problem.

And then, and, and Kate, I'm latching on to the 44 billion number, you said, yes, that applies across all of those. Now, one of the things that, uh, I found like a broken record, which I know is maybe a dated reference, but I, I keep repeating myself because one of the things that we need to prepare ourselves for as organizations is we need to be able to be resilient, right? Cyber resilient, if you want the term, right?

We need to be able to be resilient within our overall systems in, in the face of individual failures, right? So if you have to pick on, on your 1000 cameras example, right? I have 1000 cameras running in my environment, right?

But hopefully I've architected my security, uh, environment so that tho the traffic from those 1000 cameras is on a specific vlan or is on a specific FFID or is, is somehow segmented so that even though there is a volumetric anomaly in that traffic, okay, that pops up there, uh, if they try to, oh, look, we, we took over this camera, let's FFH into whatever server we want to, uh, that boundary is going to block that, right? So yes, the camera has been taken over, yes, the camera is infected. No, it's not bringing down the entire organization, right?

We need to be able to, as practitioners continuously work towards that environment, that kind of architecture, right? Where things are self, uh, I don't, uh, I remember way back when we had term self defending network where we're, we're back to it, right? But we need to be able to have that kind of, uh, of segmentation inside of our environments.

And one of the areas i i I cover is, uh, SAS E Secure Access Service Edge, right? One of the more interesting things around SASS e deployments is, so it's the idea that you now using a service, a cloud-based service to basically enforce some of that segmentation. I think that IOT devices is one of the more interesting areas for SI, because now you can radically simplify what the, the, the connectivity needs are at the edge so that you know what the device just needs to connect to a a 5G radio or, or whatnot.

Okay, great. We're you are now protected by the SAS E service and, and that takes care of, of this kind of thing. One other thing I want to bring up back to economics is that, uh, we need to, uh, Tom, you bring up the, the, the, the milling machine versus the cameras, right?

The difference in one of them costs $4 million, the other one costs 40, right? The margins that the producers have on those devices is radically different. So that $40 camera, right, has a tiny, tiny, tiny profit margin, right?

And you cannot, as a producer, uh, splurge too much on security because security costs money, right? Goes back to your friction point. Well, one of the more interesting things that happened, it's, this is, this is a weird one, is that from a scaling perspective, right?

And, and I, I credit, uh, Thomas Doan, he goes by Halvar Flake on the socials. He had the presentation a couple of years ago where he highlighted how it's cheaper for an IOT manufacturer to buy a generic purpose chip that can do a ton of stuff. It's cheaper to buy that than to buy a more specialized chip that doesn't do it.

So now all of a sudden, that camera that, or, or that PLC that has just needed a couple of controls to do it needed functionality to do five things, it now has functionality to run a full blown Linux system in there. It doesn't need to, but it's actually cheaper for the producer to build it like that. Guess what?

If you're still treating that device of, hey, it's a little PLC that can do this five or six things, and you don't realize, holy expletive, it has an actual Linux system built in, you are going to have a bad day, right? So it, it goes back to, again, I keep going back to economics, I'm sorry, right? But it's this, this thing about, uh, you, you talk about, uh, friction, there's also the friction of how expensive is it to deploy these things.

Well, I, but I think to kind of wrap up here, Fernando, it's, it's important that you bring up that it, that kind of, um, aspect of it. Because one of the things we've learned over the years in security is that no matter how complicated things get, when you can take it back to the basics and understand the challenges that are forcing these decisions, you can actually get a pretty clear picture of it. You know, economics is gonna, um, force that, as I said at our security field day event a couple weeks ago, opportunity cost spare is no one, you're always gonna be making a trade off somewhere.

But more importantly, for what we're thinking about here, you know, kind of to Kate's point, sometimes all you gotta do is ask the right questions. And the questions are, can be as simple as what is doing the talking, where does it need to speak and how much talking does it need to do? Like, like we've seen that, right?

Like the, we always go back to our favorite apocryphal stories of like the target POS hack or the, the, uh, casino fish tank thermometer hack. Does the thermometer really need to be talking to the betting system? Well, if the answer is no, and there's not a control in place to prevent that, then that's a bad security decision.

You know, if the target POS system or the HVAC system should not be talking to the POS, why are we allowing that communication? A simple deny there would have saved a whole lot of headache and quite honestly forced us to come up with a new story. But I think that, that the challenge there is though, that we still have to apply our old methods of thinking to technologies that assure us that we don't need to do that because this is all taken care of.

And I promise you that the first time that somebody comes to me and goes, oh, you don't need to worry about that security. We've taken care of all of that, I'm gonna double down on what I do because one of us doesn't know what we're talking about, and my experience has told me it's not me. All right?

Uh, we're gonna go ahead and wrap it up there 'cause we're kind of at the top of the time for this, but I wanted to give our guests a chance to kind of tell us some of the cool stuff they're working on, Kate, starting with you. Uh, if people wanna go read some of the stuff that you're working on or, or see some of the projects you're involved with, where can they go to do that? So right now, the CD Foundation has put out a, um, security guide, cybersecurity guide on how to, um, secure the software, um, the cd, the, the pipeline, the CICD pipeline.

Um, I would, I say in like three easy steps. And to me though, what's more exciting about this cybersecurity guide that came out from the CD Foundation is that you truly have cybersecurity working with the DevOps people. So to me, that has been very exciting.

And, uh, yeah, you just need to go out to, um, the CICD, uh, from Linux Foundation and look at, uh, then go drill down one more to the CD foundation and you'll see our guide. It's free and we're so happy. Um, and we'd love feedback, you know, so please, that's a big, uh, It, it's, uh, we didn't even touch on the, on the CD foundation aspects of things, right?

Because it's a, it's really interesting when you consider iot that IC CI and c modern ci cd is all about the quick feedback loop, right? How quickly can we fix something, uh, and then quickly make changes and work that, that can't be done in iot, right? I mean, if I ship a, if I ship a system that is a turnkey system, it's supposed to live for 30 years or 50 years or whatnot, i, I, I wish we had more time, Keith, perhaps we can do this again in the future.

But, um, uh, so from, from, from my perspective, from from a research angle, right? I'm, uh, I'm just wrapping up. I'm late on a report on, on software supply chain security, which again, we didn't touch in the context of, of IOT as well.

I mean, bills of materials and, and, and everything. But, uh, I'm just wrapping that report up. And then we have, um, uh, should be out by end of the months.

We should have a, uh, our cyber security decision maker survey that, that I'm working on. So we have, I think about 900 respondents, give or take. I'm, the data is coming in and, uh, uh, I'm a data geek at heart, right?

And, uh, I'm, I'm, I'm just dying to get into the, the, the cross tabs and, and, and, and whatnot. That should be fine. Uh, we also have our, uh, security operations, uh, signal report.

So Futurum has a new report type filter room signal, and, uh, uh, I'm, I'm working towards the, the security operations report, uh, security operations platforms report. So that should be out early November, I think. So yeah, it's a, it's a very busy month and, uh, uh, not as much travel.

November for travel is gonna be brutal. October for travel is not too bad. Uh, I'm, I'm happy to announce that all of the videos from Security Field Day are now posted featuring Kate and a bunch of other great delegates.

Uh, we have all of the conversations that we were able to have there up, including our, uh, enforcement round table discussion, which was kind of fascinating. Uh, there's a lot of discussion in the industry about how we should be doing these things, and I love getting different viewpoints. Um, if you don't have hours upon hours to watch every one of the videos, make sure you head over and check out the Tech Field Day takeaways that I recorded.

I picked three big points from Security Field Day that I think are something that you need to be paying attention to. Um, it's less than 10 minutes. You can get your information and go, uh, but we want to thank you all very much for listening to this episode of the Security Boulevard podcast.

If you enjoyed this conversation, please make sure you subscribe on YouTube or use your favorite podcast application, because that way you never miss an episode, it'll just get delivered right to you. The other thing we'd ask is if you could leave a rating and a review, because that does help the show grow. The more ratings and reviews we get, the more likely it's just to get put in front of the right people who need to be hearing, hearing.

com and the Futurum Group. com is the place to be. But don't forget, you can also head over to the Techstrong TV website or check out the Techstrong TV app.

It's available on Apple tv, Roku, and pretty much any smart device that you can watch things on. Make sure you're following Security Boulevard on X and Twitter as well as LinkedIn. We are at security BLVD because vowels are things you don't buy on Wheel of Fortune.

Thanks for tuning in and we will catch you next week.