Merritt Maxim and I just published our research on the IoT Attack Surface. This report gives a realistic, but not sensationalized, view of how enterprises need to think about IoT. Three factors motivated our research for this topic - attacks on IoT will transcend the digital-physical divide, the sheer scale of IoT will challenge security teams, and IoT devices collect massive amounts of data.
The following methodology allowed us to hone in on concrete enterprise scenarios:
We went for offense first. We started by interviewing prominent security researchers that spend their days thinking about how to attack IoT devices and systems. Our outside in approach allowed us to develop a threat model for intrusions, as well as identify weak points in the defenses of IoT makers, users, and operators.
We explored the ramifications of an attack. We wanted to understand what an attacker would - or could - do when successful. We also wanted to understand the amount of friction that existed for whatever came next - credential harvesting, persistence, or disrupting operations.
We examined existing security practices to understand what works, and what doesn't when defending IoT devices. This step highlighted that while IoT is different, defending IoT looks similar to other security problems S&R pros have dealt with. You can bring security lessons forward and apply them to IoT without having to learn them all over again.
Last week, WikiLeaks posted a treasure trove of internal emails from the Democratic National Committee (DNC). The leaked emails demonstrated a clear bias within the DNC against Bernie Sanders and for Hillary Clinton, when the organization claimed to be neutral. The incident:
Confirms two of our 2016 cybersecurity predictions:
In 2015, we predicted that cybersecurity would become a major issue in the 2016 US presidential election. Not only have candidates discussed cybersecurity issues such as encryption throughout the debates, with the DNC email leak, cybersecurity itself is taking center stage in the election and influencing events. It is worth noting that hacking during election season is not purely a US-related issue. The entire voter registration database of the Philippines, which included fingerprint data, was hacked this spring.
We also predicted that an executive would need to step down due to a cybersecurity breach. As the result of the embarrassing emails, the DNC chairwoman, Debbie Wasserman Schultz, has announced her resignation at the end of the DNC convention.