cloudcamp chicago - june 17, 2015 the internet of things
TRANSCRIPT
CloudCamp Chicago
“The Internet of Things”
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
Emcee
Margaret Walker Cohesive Networks
Tweet: @CloudCamp_Chi #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
… sponsored by you!
William Knowles - Evident.io Chuck Mackie - Maven Wave Partners Chacko Kurian - Complete Health Systems, LC Danai Samuriwo - tenniswithd Charlie Havens - Global Tech & Resources Jessica Hitch - Pariveda Solutions
6:00 pm Introductions 6:05 pm: Lightning Talks
The Internet of (Insecure) Things - Chandler Howell, Engineering Manager at Nexum @chandlerhowell CPL MakerLab: Intriging the General Public - Jorge Garcia, Maker Navigator for the CPL MakerLab @yorickgarcia "Connecting Vehicles on Google Cloud Platform" - David Patterson, Senior Principal at Maven Wave Partners IoT in Healthcare - Harold Clampitt, CEO & Founder at American RFID Solutions, LLC @haroldclampitt "IoT Perspectives from the Trenches" - Steven Loving, Director of Business Development at Infobrite
7:00 pm: Unpanel 7:45 pm: Networking, drinks and pizza
Agenda
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
"The Internet of (Insecure) Things"
Chandler Howell, Engineering Manager at Nexum
Tweet: @chandlerhowell #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
The Internet of(Insecure)
Things
Chandler HowellJune 2015
The Internet of (Insecure) Things
1. Smart is the New Dumb2. When Worlds Collide3. Failure Modes4. A Parade of Horrors5. So What Should I do Now?
SMART IS THE NEW DUMBIronic, really
Smart is the New Dumb
Smart, but VulnerableSecurity is not a priority of IoT (yet)
Focus is on Time to marketFeatures & Functionality
Focus is NOT onSecurityMaintainabilityLongevity
WHEN WORLDS COLLIDEWe ain’t seen nothing yet
When Worlds Collide
Lifecycles are mismatchedTechnology lifecycles are very short
Devices go EOL in 3-5 years or less
Consumer lifecycles are longerRefrigerators, coffee makers, etc. can last 10 years
Industrial Equipment may outlive youHeavy Equipment can have service lives >50 years
FAILURE MODESHow can I fail thee? Let me count the ways…
Failure Modes
1. Get Broken
2. Get Leveraged
3. Get Exploited
Failure Modes
Get BrokenDamage or destroy the device or attached devices
For example…Plant Control SystemsPeople with Pacemakers
Failure Modes
Get LeveragedCompromised Device is used as a vector for
other Badness
For Example…Unlock a Smart HomeJoin a botnetProvide a beachhead for APT
Failure Modes
Get ExploitedThe device can be used to spy on people, either
directly or indirectly
Yes, even more examples…Smart TV’sData & MetaData Collection
A PARADE OF HORRORSIt’s spelled “IoT” but it’s pronounced “Fail”
A Parade of Horrors
Welcome to the Future
A Parade of Horrors
Consumer Goods
RefrigeratorsSmart Fridges found in a botnet (2014)25% of devices in that large botnet were IoT
Televisions & ElectronicsSamsung “Smart TV” SpyingNumerous XSS, local exploits
Light BulbsLIFX “Smart” Bulbs authentication flawsDisclosed credentials for attached wi-fi
A Parade of Horrors
Medical DevicesSurgical and anesthesia devicesVentilatorsDrug infusion pumpsPacemakersExternal defibrillatorsPatient monitorsLaboratory and analysis equipment
Pretty much every type of failure you can imagine
A Parade of Horrors
CarsBlack Boxes
Data stolen or alteredRemote Lock/Unlock and starters
Key fobs and alarm protocols brokenON*Star
Hacked & Abused by Law EnforcementBraking & steering controls
Integration with entertainment/dash allowed access and compromise
A Parade of Horrors
Airplanes
DronesDefinitely
In-Flight EntertainmentDefinitely
Passenger Flight ControlMaybe
A Parade of Horrors
Infrastructure
Traffic LightsPlaintext wirelessWeak/No Authentication
Industrial Control Systems2008: Turkish Gas Pipeline Destroyed2010: Iranian Gas Centrifuges (Stuxnet)2014: Steel Mill’s Blast Furnace ($17mm in damage)
Utility MetersWeak AuthenticationInaccurate readings == Fraud
Tampered or otherwise
SO WHAT SHOULD I DO?Can I have a hint?
Fortunately, not this.
So what should I do?
So what should I do?
Realize these are not new problemsInsecure computers are nothing new
Think in terms of Failure ModesUse these to understand your threats
Expect Novel attack typesInference AttacksSide-Channel Attacks
So what should I do?
Architect for Insecure ThingsAssume devices are insecure by defaultIf not today, they will be some day
Leverage Security Tools & ProcessesDefense-in-DepthThreat ModelingIncident Response
So what should I do?
Assess whether the Smart is worth the Risk
Don’t forget how to live without IoT
Think of it in Business Continuity Planning (BCP) or Disaster Recovery (DR) termsSmart Devices are just another system to fail
Get Dumb Again
Like Power Over Ethernet (PoE) light bulbs…THANK YOU!
Well, that was fun.
"Chicago Public Library MakerLab: Intriging the General Public "
Jorge Garcia, Maker Navigator for the CPL MakerLab
Tweet: @yorickgarcia #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
"Connecting Vehicles on Google Cloud Platform"
David Patterson, Senior Principal at Maven Wave Partners
Tweet: @CloudCamp_Chi #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
Connected Bike on Google Cloud Platform
David Patterson - Senior [email protected]
Client Vision
Allow riders to “plug-in” their devices to receive information about their planned ride. Create a community to share ride experiences - popular rides, scenic roads, and POI’s
Motorcycle Manufacturer: Connected Bike POC
1
Bike Performance
Project Goals
1
2
3
Bike and location data collection
Location-based alerts
Scalable data collection
4Post-ride services and analytics
Motorcycle Manufacturer: Connected Bike POC
Motorcycle Manufacturer: Connected Bike POC
Product Inspiration Competitive Advantage
Third-party aftermarket products
Other vehicle apps - e.g. Tesla
● Tremendous brand loyalty
● Strong sense of community among
customers
● Proprietary engine codes / engineering
knowledge
Motorcycle Manufacturer: Connected Bike POC
Engine byte stream Onboard Location
Data Acquisition
LOCATION
ALERTPRECIPITATION FORECAST
Alerts pushed to preferred rider and/or passenger devices
Motorcycle Manufacturer: Connected Bike POC
Google App Engine
Backend
Precipitation Alerts
Dashboards showing real-time positioning and engine metrics
Motorcycle Manufacturer: Connected Bike POC
Motorcycle Manufacturer: Connected Bike POC
Android
App Engine
Datastore
BigQuery
Google Cloud Messaging
Guaranteed push notifications to mobile devices
Fully managed application platform. Cost scales with application adoption
Fully managed NoSQL data storage. Extremely scalable random I/O
Big Data Service to perform interactive analysis on massive amounts of data
Native client application
Clients & Frontends
Backend Services
Storage
Motorcycle Manufacturer: Connected Bike POC
Data Providers
Ride Data
2
6
4
3
5
7
1
Thank You
"IoT in Healthcare" Harold Clampitt, CEO & Founder at American RFID Solutions, LLC
Tweet: @haroldclampitt #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
American RFID Solutions, LLC © 2015
American RFID Solutions, LLC © 2015
American RFID Solutions, LLC © 2015
• ‘things’ have an aperture and become active participants:
in business
in vacations
In hobbies
• information and processes offer real time situation awareness
interact and communicate:
among themselves
with the environment by exchanging data and information
‘sensed’ about the environment
• running processes:
trigger actions
create services
autonomously with or without direct human intervention
American RFID Solutions, LLC © 2015
"IoT Perspectives from the Trenches"
Steven Loving, Director of Business Development at Infobrite
Tweet: @ Infobrite #cloudcamp
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
Internet of Things
“Lightning” Talk
Cloud Camp Chicago
Steven Loving (IoT Chicago Meet-‐up)
2015
2
3
4
Consumer Safety. Protect home investments with affordable remote monitoring.
Savings. Save money by decreasing energy usage from home products.
Comfort. Maximize time with remote home product and appliance management.
Smart Service. Take advantage of remote diagnostic testing and advanced customer service programs.
Green. Reduce energy consumption and protect the environment.
Value, Growth, Savings Driving Business and Consumer Benefits
Business Diversify. Diversify revenue strategies and earn income from new sources.
New Markets. Engage current and high potential mobile customers.
Efficient Diagnostics. Save money with remote product diagnostic testing and monitoring.
Quality Customer Service. Provide best-in-class customer service with new product information and advice.
Brand Reputation. Build brand reputation for product innovation and leadership.
5
Industrial Automa3on Smart Health
Smart Home Smart City
“Things having iden33es and virtual personali3es opera3ng in smart spaces using intelligent interfaces to connect and communicate within social, environmental, and user
contexts”
6
7
Devices, Products, Assets On-‐premise, In the field
M2M Enabled Devices
Device PlaOorm Applica3on PlaOorm
Smart Enterprise Infrastructure
Smart Product Developm
ent
Network
M2M Sensors Actuators
LAN, WIFI Cellular
M2M
Gateway
WAN
Device Mgmt. Enablement Cer3fica3on Provisioning Security Data Rules Alerts Real Time Analy3cs
Data Collec3on Applica3on Integra3on Analy3cs Dashboards Data Models Applica3on Dev. Applica3on Sec. Enterprise Systems
1+N
8
9
10
Devices speak wirelessly to Home hub
Hub plugs into home router to access Internet
Cloud links devices, applica3ons and analy3cs
Consumer controls Home from phone
11
Whirlpool 6th Sense
“20 % of your day is used For meal / clothes mgmt”
IoT Use Cases: • Home AutomaNon • Energy Savings
MSRP Various (washer, dryer, dish, frig.)
EsNmated Volume 50,000+
ConnecNvity Wi-‐Fi
Channels
11
“Never worry if your garage door is open again”
IoT Use Cases: • Awareness & ProtecNon • Home AutomaNon
Product Use Cases • Control your garage door and your
house lights through your smart phone • Get noNfied if your garage door opens or
if you forgot to close your garage door • Know if your garage door opened while
you were away
MSRP $129.99
EsNmated Volume 250,000+
ConnecNvity Wi-‐Fi
Channels
Chamberlain MyQ
12
13
A Connect Cloud Pla`orm -‐ Sample
AES 128 Encryp3on and key management from the device. SSL and two factor authen3ca3on for data transfer and storage in the cloud.
Normalize Data to your exis3ng ERP, CRM and BI systems
Both backup & recovery and 3me series storage available using dedicated virtual machines running Cassandra DB Android, iOS, and
Windows Push no3fica3ons, SMS, and email
Real 3me weather and 3me of day energy pricing
SLA: -‐ 99.9% up3me -‐ Sub-‐second latency
Mobile appp development plaOorm to speed app development.
• Technology is Fragmented – Lack of Common Standards (fragmented) – Closed Systems
• Users are Concerned – Security / Privacy Challenges – Complexity
• Business Challenges
14
Actor
Cloud (s)
Device
Actor
Devices / Data
Sensors
Actor
Interface
Devices
Device
Interface
Device
Interface
Systems, Products Services
Other Service Users
Mac/PC
Smartphone
Smartphone Screen
Smartphone
Accelerometer
Products (1+N)
15
16
Thank You
17
Un-panel Discussion
volunteer to join the panel & ask questions from the floor!
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by
Unconference
Small groups & discussions, network
Pizza’s almost here!
#cloudcamp @CloudCamp_CHI
Sponsored by
Hosted by