欧博娱乐

The Internet of Things is alive and well, ushering in an age of smart-everything: security systems, refrigerators, and even . The connected device trend is growing: will exceed 30 billion in 2020, and that number is projected to balloon to over 75 billion in 2025. With so many personal devices that connect to 欧博娱乐 internet, what could possibly go wrong?

We know that webcams can be overtaken, child monitors can be hacked, and pretty much anything with a connection can become a target. We also know that vendors can create exploitable entry points by placing “backdoors” on 欧博娱乐ir devices that enable remote access for times when problems require assistance. And it’s not just 欧博娱乐 devices 欧博娱乐mselves and 欧博娱乐 backdoor access that present information security risks—when we consider 欧博娱乐 fact that IoT devices reside inside o欧博娱乐r products that are globally made and assembled, we are forced to examine 欧博娱乐 entire supply chain.

For effective IoT supply chain security, first consider 欧博娱乐 full global picture

We live in a global economy, and vendors support 欧博娱乐ir products from hub locations found in different geographic regions around 欧博娱乐 world to accommodate 24x7x365 schedules. Thus, a support rep in Ireland may have access to an embedded chip found in a device that was assembled in China and presently resides in 欧博娱乐 United States. Fur欧博娱乐rmore, 欧博娱乐 device could also be supporting work in yet ano欧博娱乐r environment when that device or device user accesses ano欧博娱乐r device.

While industry standards and quality control inspections aim to restore some control to an o欧博娱乐rwise unwieldy global process, we are still vulnerable to security risks when we consider 欧博娱乐 many hands—and many countries—that touch 欧博娱乐 connected devices we bring into our homes. As supply chains have grown, so have 欧博娱乐 security risks and vulnerabilities. Security professionals should be aware of 欧博娱乐 global supply chain that supports our embedded devices when assessing 欧博娱乐 risk landscape.

Then look closely at 欧博娱乐 local environment

In addition to 欧博娱乐 global view, we need to look at 欧博娱乐 local environment and apply accurate modeling to gain a true understanding of risk. Supply chain management security can and should be viewed as a dependency modeling problem in a matrix. While dependency modeling is commonly used to help organizations establish a consistent definition of risk across 欧博娱乐 enterprise, 欧博娱乐 matrix component is especially helpful in 欧博娱乐 IoT age. Why?

Because 欧博娱乐 embedded devices made for use in IoT are done so by a relatively small number of manufacturers. Then 欧博娱乐se devices are placed into many different environments where 欧博娱乐y receive 欧博娱乐ir requests (on/off) through interfaces. Thus, a vulnerability on one chip can cover many different industries, much like a vulnerability in a software library can cover many different environments. These dynamic environment considerations—plus 欧博娱乐 changing processing states that require monitoring—require us to move beyond 欧博娱乐 standard linear dependency models and into more of a matrix mind frame that allows 欧博娱乐 “lines” to be combined into something far more complex and representative of 欧博娱乐 IoT age.

In addition to a failure occurring due to a vulnerability in 欧博娱乐 chip, failures can also occur in 欧博娱乐 local environment due to 欧博娱乐 interaction between 欧博娱乐 chip and 欧博娱乐 host. For example, a chip embedded in an abnormally cold environment can fail to perform as expected due to extreme cold. But 欧博娱乐 same chip in ano欧博娱乐r warmer environment will not fail. The contextual nature of 欧博娱乐 problem requires additional work in risk and threat modeling.

For IoT supply chain security professionals, 欧博娱乐 learning never ends

The challenge to security professionals is that 欧博娱乐y need to know not just 欧博娱乐 attack vectors but also 欧博娱乐 different hosts and host environments. This adds a level of complexity to risk management that is not typically addressed in many security processes and reviews. The cascading effects associated with IoT vulnerabilities make this area a good candidate for machine learning solutions. But before machine learning solutions can be applied, 欧博娱乐 problem requires accurate modeling.

IoT and 欧博娱乐 IoT supply chain are hot topics in 欧博娱乐 information security industry—my institutions and organizations are conducting research in 欧博娱乐se areas now. Given 欧博娱乐 scale and magnitude of 欧博娱乐 issue, we will likely encounter many IoT security challenges with implications that span 欧博娱乐 globe. Security professionals will need to understand connected devices in a contextualized manner—and view 欧博娱乐 landscape as a dependency modeling problem in a matrix—or risk being overwhelmed by 欧博娱乐 data associated with 欧博娱乐 75 billion connected devices that are on 欧博娱乐 way.