Instructor: Internet of Things Vulnerabilities. 2 2
In this lesson, we're going to start talking 3 3
about IoT or the internet of things. 4 4
Now, when I talk about internet of things, 5 5
you may have heard this term before, 6 6
and you really should if you've talked about A+, 7 7
or Net+, or Security+, 8 8
because these are all things that connect to our network. 9 9
It can be things like trains, planes, and automobiles. 10 10
It can be shopping carts. It can be your smart TV. 11 11
It can be your cell phone. 12 12
Pretty much anything that can connect to the internet 13 13
could be considered an internet of things. 14 14
For instance, there's some refrigerators out there right now 15 15
that have the ability of connecting to the internet 16 16
and using things like Alexa to be able to add things 17 17
or take things away from your shopping list. 18 18
All of that is part of the internet of things. 19 19
So when we define the internet of things or IoT, 20 20
we're really just talking about a group of objects 21 21
and they can be electronic or not, 22 22
and they all have to be connected to the wider internet 23 23
by using embedded electronic components. 24 24
That is what we define the internet of things. 25 25
So if you think about your home, if you have a smart home, 26 26
you might have a smart door lock on the front door 27 27
that you use to get in. 28 28
You have a camera that's sitting there to see people 29 29
as they come up to your doorbell. 30 30
And if they press on your doorbell, 31 31
that can actually ring on your cell phone 32 32
so you can know who's at the door 33 33
before you get up from your couch. 34 34
You might have a smart air conditioner that can keep track 35 35
of what the temperature's in the room, 36 36
and you can set it, and you can change it 37 37
from anywhere in the world because it's internet connected. 38 38
You might have a lighting system where you can control 39 39
if it's going to be white or red or blue lights 40 40
because they're connected to the internet too. 41 41
And you could talk to that through your smartphone. 42 42
You may have energy management or appliance control. 43 43
You may have a smart device 44 44
like a smart TV or a smart speaker. 45 45
All of these things are different things 46 46
that we can connect inside of our house, 47 47
and they all give us a lot of great capability. 48 48
But the biggest problem 49 49
with these things is they're not always secure. 50 50
And security is most often an afterthought to convenience 51 51
when we start talking about smart devices. 52 52
Now, most of our smart devices are going to use 53 53
an embedded version of Linux or Android 54 54
as their operating system. 55 55
And so because they have Linux or Android 56 56
as their operating system, they are vulnerable to attack. 57 57
If there's a Linux vulnerability out there 58 58
and you're using a Linux version on that smart device 59 59
and that vulnerability matches, 60 60
it can actually attack your smart speaker, for instance. 61 61
And so these are things you have to think about 62 62
as you start looking at your network, 63 63
because if they're connected to your network, 64 64
'cause you have a smart TV in the conference room, 65 65
that could be an attack vector 66 66
for somebody to get into your network. 67 67
And that is one of the most common places I see people 68 68
getting into a network through 69 69
it's things like smart devices that are now connected 70 70
to the corporate network. 71 71
So you want to make sure they're properly installed, 72 72
secured, and segmented 73 73
when you put them into your corporate network 74 74
if you're going to put 'em in your corporate network. 75 75
Now these smart devices must be secured and updated 76 76
when there's new vulnerabilities that are found. 77 77
As I said, they're just running Linux or Android. 78 78
And what happens is a lot of times, 79 79
people will never update the software on these devices. 80 80
So you might be running a version of Linux 81 81
that's five years old 82 82
because it was small and easy to put on a device. 83 83
But you've never updated, 84 84
so now it's got this huge vulnerability. 85 85
So when you think about IoT, the idea of IoT and security, 86 86
they really don't go together very well 87 87
because most IoT manufacturers are not thinking 88 88
about security when they build these devices. 89 89
People buy smart speakers and lights and smart devices 90 90
because they want convenience, 91 91
and most people aren't thinking about security. 92 92
So if you're going to install these things 93 93
in your corporate network, 94 94
you really have to think about this with a security lens. 95 95
And one of the best things you can do 96 96
is segment these devices often to their own network. 97 97
So they're not talking to the rest of the corporate network. 98 98
Don't allow them to be a device that people can use 99 99
to be able to pivot into your network 100 100
and get your corporate data.