Week 12 Flashcards
Internet of Things
Internet of Things (IoT) - any computing device with the ability to transfer data over a network
Low cost sensors, computing, and communication put embedded smarts in all sorts of devices so that these products can communicate with one another for data collection, analysis, and collective action
IoT is a network of dedicated physical objects (things) containing embedded technology for communicating and sensing or interacting with their own internal states or the external environment
Interactions within an IoT system
Interactions within an IoT system
(1) things with networked sensors (at rest –> active)
(2) data stores (data, videos, test, models/analysis)
(3) analytic engineers (human/machine learning, sensors/cloud)
things with networked sensors -> report states (internal states/external status –> data stores
data stores –> iterate (models/analyses) –> analytic engines
analytic engines –> feedback and control (commands and requests) –> things with networked sensors
Business benefits of IoT
Business benefits of IoT
- increase productivity
- automate process
- optimize value chain
- improve customer experience
- create new business models
IoT device risks
IoT device risks:
- outdated software or firmware
- lack of encryption to protect transmitted data
- weak authentication requirements
- default administrative passwords
IoT device risk mitigations
IoT device risk mitigations:
- where possible, contract equipment from known viable and reputable manufacturers or IoT service providers
- ensure the existence of an appropriate update frequency for device software/firmware
- implement appropriate encryption and end-point security
- change default administration passwords from manufacture to a password that complies with organizational IT policies
IoT data storage risks
IoT data storage risks:
- IoT stored in the cloud may not be adequately protected when managed by an IoT service provider
IoT data storage risk mitigations
IoT data storage risk mitigations:
- business should specify security and protection requirements
- service provider should agree to specific requirements for cloud security in a contractual agreement
- service provider should provide a third-party assurance report on their cloud security and if needed privacy and compliance with contractual obligations
- consider leverage edge computing to process the IoT data on a local device to eliminate the amount of sensitive data being transmitted
IoT data breach risks
IoT data breach risks:
- the IoT data breached may include personally identifiable information
IoT data breach risk mitigation strategies
IoT data breach risk mitigation strategies:
- generally, stored data should be encrypted with personally identifiable information stripped out in order to minimize the impact of information theft resulting from a data breach
- if personally identifiable information is required to be collected and stored, ensure compliance with local privacy laws such as the Personal Information Protection and Electronic Documents Act (PIPEDA)
- Prepare a data breach response plan that should include steps to: contain the breach, evaluate the risks as a result of the breach, notify impacted persons, prevent future incidents
IoT network risks
IoT network risks:
- network infrastructure may not support bandwidth demands from IoT devices
IoT network risk mitigations
IoT network risk mitigations
- Each IoT devices will utilize a portion of available bandwidth on the network. As more devices are added to the IoT network, businesses must ensure adequate bandwidth is available to support communication between these devices and critical applications. Otherwise, network downtime may reduce employee productivity or provide a negative customer experience
- edge computing moves the processing of data generated by IoT devices from the cloud back to the device, thereby reducing bandwidth demands
IoT employee risks
IoT employee risks:
- employees may gain unauthorized access of IoT devices through personals mobile devices
- employees may gain unauthorized physical access to IoT devices
IoT employee risk mitigations
IoT employee risk mitigations
- create a separate private network for IoT devices that are not shares with the network accessible by employee devices
- ensure passwords for IoT devices are secure by changing them from manufacturer defaults to forms that meet organizational IT policies
- review IoT devices periodically to ensure order casing has not been tampered with
- place IoT devices in locations where access controls are secure and limited to authorized individuals
- review logs for IoT devices periodically and investigate those where the device has gone offline. Typically, to maliciously tamper an IoT device would require bringing it offline and rebooting it
