When things are increasingly connected, how do you plug in business value? Piotr Ciepiela Protect the disrupted June 27, 2017

Size: px

Start display at page:

Download "When things are increasingly connected, how do you plug in business value? Piotr Ciepiela Protect the disrupted June 27, 2017"

Justin Fleming
6 years ago
Views:

1 When things are increasingly connected, how do you plug in business value? Piotr Ciepiela Protect the disrupted June 27, 2017 The b etter the qu es tion. The b etter the an swer. The b etter the world works.

avoid wasted trips to an empty coffee pot 1991 The first

2 The first connected webcam Deployed at a Cambridge University computer lab to monitor a coffee maker so that lab users could avoid wasted trips to an empty coffee pot 1991 The first connected Thing Source:

3 It used to be Now

4 COMPUTING POWER COST CONNECTIVITY $1200 Transfer cost of 1MB of data dropped from $1200 (1998) to $0.63 today SCALE $569 Storage cost of 1GB of data decreased from $569 (1992) to $0.02 today $0,63 6.3bn 20.8bn 2014 and $0,02

6 M Strict Security Control M M M M M M M M M M M M M M M

7 Humidity sensor Humidity sensor Humidity sensor Humidity sensor Humidity sensor

8 Pressure sensor Pressure sensor Pressure sensor

9 Proximity sensor Proximity sensor Proximity sensor

10 Hall probe Hall probe A Hall effect sensor is a transducer that varies its output voltage in response to a magnetic field. Hall effect sensors are used for proximity switching, positioning, speed detection, and current sensing applications Hall probe

11 Smoke detector Smoke detector Smoke detector Smoke detector Smoke detector

12 Humidity sensor Pressure sensor Proximity sensor Hall probe Smoke detector

13 Humidity sensor Pressure sensor Proximity sensor Hall probe Smoke detector

14 Humidity sensor Pressure sensor Proximity sensor Hall probe Smoke detector

15 Humidity sensor Pressure sensor Proximity sensor Hall probe Smoke detector

16 Humidity sensor Pressure sensor Proximity sensor Hall probe Smoke detector

17 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

18 Classic approach to technology implementation Idea Prototype Proof of Concept Pilot Ready for Sales Implementation Something new Innovation Which problems to solve? What is the market? How much can we earn? What components to be used? How to build it? What are the features? How much will it cost? How to show the features? How to make it replicable? How to fix the issues? How to testify the value? How to achieve the same results in real life environment? How to cover the bugs? How to testify the value? How to reach to potential clients? How to spread the word? How to gain attention? How much can we spend more? How to meet the deadlines? How to pass the tests? How to make profit? How not to breach the contract?

19 Approach to implement IoT smart devices Idea Prototype Proof of Concept Pilot Ready for Sales Implementation Who thinks about safety and security? Source: ISE GmbH Source: Ortner Group Source: Rafayel Ghasabyan

20 What you see. isn t always what you get

21 In the early days of the Internet, no one worried about security. Those days are long gone. In the early days of the Internet of Things, no one worried about security

22 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

Dependent on: Device manufacturers Wireless carriers Chipset makers Components providers: for touchscreens, LCD Screens, sensors, batteries Accelerometer Proximity sensor Ambient

23 Dependent on: Device manufacturers Wireless carriers Chipset makers Components providers: for touchscreens, LCD Screens, sensors, batteries Accelerometer Proximity sensor Ambient Light sensor Moisture Sensor Compass Gyroscope Barometric Pressure Sensor Captive optical scanner Pressure sensitive screen NFC Camera Microphone Speaker Bluetooth agps Wi-Fi Cellular modem

Number Bugs in 1000 LOC: Very good programmer Average programmer 3-4 bugs 10 bugs Number of Lines of Code: F-22 Raptor fighter jet 1,7m US military drone control

24 Number Bugs in 1000 LOC: Very good programmer Average programmer 3-4 bugs 10 bugs Number of Lines of Code: F-22 Raptor fighter jet 1,7m US military drone control software 3,5m X-Box HD DVD Player 4,7m Boeing 787 6,5m 5k 10k 14k 19k 17k 35k 47k 65k Ford GT (mission critical) 10m 30k 100k Android 12m 36k 120k Windows 10 >50m 150k 500k

25 Fiat Chrysler Automobiles is equipping its factory line workers with Samsung's Gear S3 Frontier (smartwatch) packed with info about "daily work load and demands", as well as the option to talk to fellow production line workers "through the press of a button." Samsung was picked because its S3 integrates with FCA's Manufacturing Execution System, so workers will actually be using the smartwatch as part of their job. FCA says it "streamlines processes, improves work flow and delivers labour-saving benefits. Source: Photo:

26 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

27 IT pattern

28 OT pattern

Extends the scope of the EU data protection law to all foreign companies processing data of EU residents Harmonization of the data protection

31 Extends the scope of the EU data protection law to all foreign companies processing data of EU residents Harmonization of the data protection regulations throughout the EU Strict data protection compliance regime Penalties of up to 4% of worldwide turnover or 20m EUR, whichever is greater

32 SECURITY SECURITY Warehouse of the Future Asset Performance Mangement increases equipment effectiveness and reliability Advanced Metering Infrastructure increases power efficiency Augmented reality in SCM Inteligent Tracking & Last Mile Delivery SECURITY Cloud Machine Learning BI AI Advanced Analytics

33 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

34 Printed maps You need to Select the route Understand the map can be outdated Navigate yourself

35 GPS Navigation Selects routes Turn by turn navigation TomTom s automotive revenue drops 19% Y/Y* You need to Decide where to go Select one of the options *source:

36 Waze (Social navigation) Social Live traffic and reports Dynamic routing Calendar synchronization Reminders Dynamic Points of Interest You need to Just drive we will do the rest

37 I don t know! Fully reliable on system No surroundings observation No focus on the route No environment reading

38 *source:

39 New talent challenges for the days of the Internet of Things: Training and simulations to be prepared for critical situation Preserving and refreshing the knowledge in the organization Approach to taking calculated risk of relying to third parties technology Page 39

40 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

41 Inappropriate authentication Compromised user accounts Faults in real-time measurements Threat to security and business continuity Lack of transmission encryption The threat of data leak and modification Physical and environmental security Threat of control acquisition or device damage Unsecured personal data Leakage of personal data Lack of devices age management Threat to security and business continuity Insufficient configurability of security The threat of data leak and modification No systems / data classification Hindered emergency response Unprotected Software / Firmware The threat of taking control over devices No suppliers and service providers management Threat to business continuity The weakness of physical protection The threat of taking control over devices Inadequate process state monitoring Automation equipment security risk Unsecured web interface Compromised devices and clients No restrictions on access to the control functions The threat of data leak and modification and work safety Unsecured network services The threat of Denial of Service attack Lack of control algorithms version control Threat to taking control of devices Unsecured cloud interface The threat of data leak and modification No fail-safe and control functions separations Threat to taking control of devices Unsecured Mobile Applications interface The threat of data leak and modification

42 Battery drain attack Consequences Force device to perform an action (e.g. measurement) Force device to increase the frequency of package send/receive action Infinite loop commands Power demanding processes $6 battery Device unavailability (not responding, powered down) Device operations slowing down Cost of battery replacement General security rule: The cost of security cannot exceed the cost of an asset

43 !!!!!!!!!!!!!!!! The safety and security concerns related to IoT adoption are distributed across organization Source:

44 Arleigh Burke class destroyer SPY-1D Passive Electronically Scanning Array (PESA) radar with 4 panels, operating in the S-band for air/surface search and target tracking. It has a range of 350+ km. 3 x SPG-62 illuminators to provide terminal target illumination for its semi-active radar homing SAMs. 1 x SPS-67 surface search radar 1 x bow mounted sonar 1 x towed array sonar 30 Types of Navigation Equipment and Resources Used Onboard Modern Ships by Marine Insight Gyro Compass Radar System Rudder Angle Indicator Forecastle Bell Maneuvering Booklet Magnetic Compass Auto Pilot Voyage Data Recorder Rate of turn indicator Black Ball Shape Record of Navigation Activities Automatic Radar Plotting Aid Automatic Tracking Aid Speed & Distance Log Device Echo Sounder Electronic Chart Display Information System Automatic Identification system Photo: Flickr / Naval Surface Warriors Long Range Tracking and Identification (LRIT) GPS Receiver Sound Reception System Navigational Lights Ship Whistle Daylight Signaling Lamp Pilot Card Voyage Plan Record of Maintenance of Navigational Equipment Wheelhouse Posters Transmitting Heading Devise Black Diamond Shape Ship Flags Photo: Flickr / Naval Surface Warriors

Arleigh Burke class destroyer SPY-1D Passive Electronically Scanning Array (PESA) radar with 4 panels, operating in the S-band for air/surface search

1 x SPS-67 surface search radar 1 x bow mounted sonar 1 x towed array sonar 30 Types of Navigation Equipment and Resources Used Onboard Modern Ships

Speed & Distance Log Device Echo Sounder Electronic Chart Display Information System Automatic Identification system Long Range Tracking and

Lights Ship Whistle Daylight Signaling Lamp Pilot Card Voyage Plan Forecastle Bell Maneuvering Booklet Black Ball Shape Record of Navigation

45 Arleigh Burke class destroyer SPY-1D Passive Electronically Scanning Array (PESA) radar with 4 panels, operating in the S-band for air/surface search and target tracking. It has a range of 350+ km. 3 x SPG-62 illuminators to provide terminal target illumination for its semi-active radar homing SAMs. 1 x SPS-67 surface search radar 1 x bow mounted sonar 1 x towed array sonar 30 Types of Navigation Equipment and Resources Used Onboard Modern Ships by Marine Insight Photo: Royal Museum Greenwich Gyro Compass Radar Magnetic Compass Auto Pilot Automatic Radar Plotting Aid Automatic Tracking Aid Speed & Distance Log Device Echo Sounder Electronic Chart Display Information System Automatic Identification system Long Range Tracking and Identification (LRIT) System Rudder Angle Indicator Voyage Data Recorder Rate of turn indicator GPS Receiver Sound Reception System Navigational Lights Ship Whistle Daylight Signaling Lamp Pilot Card Voyage Plan Forecastle Bell Maneuvering Booklet Black Ball Shape Record of Navigation Activities Record of Maintenance of Navigational Equipment Wheelhouse Posters Transmitting Heading Devise Black Diamond Shape Ship Flags Photo: Flickr / Naval Surface Warriors

46 What is the cost of such threat? What about capability enhancements? What happens if I upgrade legacy systems with new advancements? Who controls component producers?

47 Vendors build devices but now it is time for building secure devices Now everything is connected we need an ecosystem mindset We need to think about contingency plan when automation fails

48 Thank you Piotr Ciepiela EMEIA OT/IoT Security & Critical Infrastructure Leader

G SERIES: Security INTEGRATION as you want it. Greater expansion, communication, video integration, system resilience, and automation.

G SERIES: Security INTEGRATION as you want it Greater expansion, communication, video integration, system resilience, and automation. G Series Integrated Security Solution Fire Intrusion Access Greater