Date post: | 13-Apr-2017 |
Category: |
Technology |
Upload: | david-glover |
View: | 212 times |
Download: | 0 times |
IoT Security Considerations in the Enterprise
Lee Hickin | IoT Product Manager | @leehickinDave Glover | Developer Evangelist | @dglover
• Who are we & what do we do• Microsoft, IOT, Open Source &
Security• IOT Security – layers of
consideration• STRIDE – Understanding the
Threats
Agenda
• Threat Modelling and Determine Risks• Hardware and Device Capabilities • Price Point Considerations
• Updates• You can’t secure what you can’t update
• Secure Communications• Cloud Security
IoT Security Considerations
Device
Device Environment
Field Gateway
Cloud Gateway
Services
Four zones of IoT securityTr
ansp
ort P
roto
cols
1
2
34
Devices
• UEFI Secure Boot and Measured Boot (Boot Attack)• Bitlocker and TPM Support (Offline Attack)• Windows Update• Trusted Cryptographic Services• Storage and Communications
• Universal Windows Platform• Capability and Permission• Managed Memory• Signed executables
Enterprise Grade Security for IoT Assets
Windows 10 IoT Enterprise1 GB RAM, 16 GB StorageX86
Enterprise Manageability and Security
Rich user experienceWin32 & UWP
Windows 10 IoT Editions
Handheld devicesModern Shell & UWP
lockdown and multi-user support
Windows 10 IoT Mobile512 MB RAM, 4 GB storageARM
Optimized for small & low cost IoT devices
Single UWP App experienceLow cost silicon
Windows 10 IoT Core (OEM Pro Edition)256MB RAM, 2GB storageX86 or ARM
Windows 10 Enterprise for IoT devices
Windows 10 Mobile Enterprise for IoT devices
New Windows 10 version for IoT devices
Windows 10 IoT Core Platforms
DISCOVERnearby friendly devices
IDENTIFYservices runningon those devices
ADAPTto devices comingand going
MANAGEdiversetransports
INTEROPERATEacross different OSes
EXCHANGEinformation and services
SECUREagainst nearby bad actors
IoT Interoperability and AllJoyn
TransportGatewaysServices
HTTPSAMQPS
Azure IoT Hub IoT Hub
Up to 10M Devices per Hub
Identity Registry
Device Management Provisioning
IoT Hub Gateway
HTTPS,AMQPS,MQTT
Data and Command Flow
Per-device command
queues
Event HubSelf
Hosted Gateway
MQTT,Custom
Field Gateway
OPC UA,MQTTCoAP,
AllJoyn, ...
CloudFieldM
MM
APIs
OSS Device Agents
Management
Communication
Provisioning
Azure IoT Hub OSS Device Agents
Harness
Microsoft Azure IOT SuiteConnect technology assets to other devices, cloud-based services and infrastructure
Address variable demand with scalable, efficient data collection and storage in the cloud
Configure rules and executable scripts that define actions on devices
Connect
Configure
Extend
Administer Apply business rules to remotely manage and govern devices
Intelligent Systems ServiceAzure IOT Suite
Efficiently capture, store, visualize and analyze data to drive meaningful business insights
1. Draw an application diagram and then decompose the architecture2 Assign the STRIDE mnemonic to each element in the diagram
3 Determine the risk
4 Chose mitigations (or not!)
IoTThreat
Modeling STRIDES –> Spoofing IdentityT –> Tampering R –> RepudiationI –> Information DisclosureD –> Denial of ServiceE –> Elevation of Privilege
© 2015 Microsoft Corporation. All rights reserved.
Backup Slides
Source HP Fortify: Defence for the Internet of Thingshttp://www8.hp.com/hpnext/posts/hp-fortify-defense-internet-things-iot
Top Devices Have Major Security Weaknesses
Microsoft Azure IoT Services
Devices Device Connectivity Storage Analytics Presentation & Action
Event Hub SQL Database Machine Learning App Service
IoT Hub Table/Blob Storage
Stream Analytics Power BI
Service Bus DocumentDB HDInsight Notification Hubs
External Data Sources 3rd party
Databases Data Factory Mobile Services
Data Lake BizTalk Services
{ }
Threats in the IoT platformSTRIDE Threat ImplementationSpoofing How do we know we are talking to the right
deviceAuthentication Secure Channels
Tampering How do we make sure that the device was not tampered with (physically or environmentally)
AuthorizationSecure Channels
Repudiation Modifying audit logs AuthenticationSecure logging and auditingDigital Signatures
Information Disclosure
Eavesdropping on the communication EncryptionAuthorization
Denial of Service DoS against service/device (resource exhaustion, power drain,…)
ThrottlingHigh Available designAuthorizationControlling inbound connections
Elevation of Privilege Forcing the device/service to do something it was not supposed to do
AuthorizationLeast privilege
Policies, Procedures, Guidance
Defense in DepthCloud Field Gateways Devices
Physical
Global NetworkIdentity and Access Control
ApplicationData
Physical Physical
Local Network Local Network
EdgeApplicationData Data
HostHostHost
Data Privacy Protection and Controls
People and Device Identity Federation, Data Attestation
Trustworthy Platform Hardware, Signed Firmware, Secure
Boot/Load
Secure Networks, Transport and Application Protocols,
Segmentation
Tamper/Intrusion Detection Physical Access Security
IoT Sweet Spot $1000 PCs$400
Phones
• IoT capabilities are primarily value-add to other primary capabilities
• How much computer, storage, and networking circuitry can you add to the BOM for a $40-range retail product for that value-add?
• Tiny devices make awfully vulnerable network servers
Capability constrained devicesCost
Computational CapabilitiesMemory/Storage Capacity
Energy Consumption/Source
$1 Senso
r
$10000
Server
Component Quality
• IoT Security is a shared responsibility• Security concepts to the edge • Device code, provisioning, certificates, data management
• Implement a Secure Development Lifecycle• http://microsoft.com/sdl• Keep track of the cyber supply chain• Work out an incident response plan that includes updates
• Leverage industry best practices for defense-in-depth• Select device platforms by best balance between feature and security
capabilities for your scenario and budget.• Leverage best practice network design, but don’t just trust the
network. • Establish security boundaries at the application layer
Call to Action!
• Build on the Azure IoT Suite and IoT Hub• Secure, Service Assisted, Bi-Directional Communication• Hyper-Scale Device Identity Management• Device Management Foundation
• Review our platform principles and certifications• Azure Trust Center
http://azure.microsoft.com/en-us/support/trust-center/
Call to Action!
ISO 27001/27002SOC 1/SSAE 16/ISAE 3402 and SOC 2Cloud Security Alliance CCMFedRAMPFISMAFBI CJIS (Azure Government)
PCI DSS Level 1United Kingdom G-CloudAustralian Government IRAPSingapore MTCS StandardHIPAACDSAEU Model Clauses
Food and Drug Administration 21 CFR Part 11FERPAFIPS 140-2CCCPPFMLPS
Improve your skills by enrolling in our free cloud development courses at the Microsoft Virtual Academy.Try Microsoft Azure for free and deploy your first cloud solution in under 5 minutes!Easily build web and mobile apps for any platform with AzureAppService for free.
Resources
Internet
ISP
(Mobile) Network Operators
Personal Environment and Networks
Complex Connected Things
Device
Device
Device
Device
Field Gateway
Cloud Systems
Device
Cloud Gateway
Device
LocalInteraction
MNOGatewa
y
Cloud Portals and APIs
Mobile & WebInteraction
Control System
Analytics
Data Management
Watches, Glasses, Work Tools, Hearing Aids,
Robotic Assistance, …
Homes, Vehicles, Vessels, Factories, Farms,
Oil Platforms, …
Vehicle Fleets, Sea Vessels, LV Smart Grids,
Cattle, …
Local Gateway
Local Portals and APIs
Control System
Analytics
Data Management