1
00:00:06,510 --> 00:00:09,150
- In this lesson, we're going
to focus on another type

2
00:00:09,150 --> 00:00:13,053
of embedded system called the
Internet of Things, or IoT.

3
00:00:13,920 --> 00:00:15,540
Now the Internet of Things, or IoT,

4
00:00:15,540 --> 00:00:19,650
refers to a network of
physical objects, or things,

5
00:00:19,650 --> 00:00:22,290
embedded with sensors, software,

6
00:00:22,290 --> 00:00:25,500
and connectivity that
enable them to exchange data

7
00:00:25,500 --> 00:00:27,390
with other connected devices,

8
00:00:27,390 --> 00:00:29,910
and interact with users over the Internet.

9
00:00:29,910 --> 00:00:32,940
Sometimes we use the term
smart devices to refer

10
00:00:32,940 --> 00:00:34,950
to that ability to interact

11
00:00:34,950 --> 00:00:36,813
with our users over the internet.

12
00:00:38,640 --> 00:00:40,530
Now there is another internet

13
00:00:40,530 --> 00:00:42,210
of things you might not
be as familiar with.

14
00:00:42,210 --> 00:00:43,950
It's called the IIoT.

15
00:00:43,950 --> 00:00:45,930
It's the Industrial Internet of Things.

16
00:00:45,930 --> 00:00:50,040
And that refers to the
application of IoT technology

17
00:00:50,040 --> 00:00:52,470
and principles in industrial settings

18
00:00:52,470 --> 00:00:53,910
with the goal of improving

19
00:00:53,910 --> 00:00:57,420
efficiency, productivity, and safety.

20
00:00:57,420 --> 00:00:59,790
Now, so it refers to the
use of connected sensors

21
00:00:59,790 --> 00:01:03,720
and devices and machines in
manufacturing, in logistics,

22
00:01:03,720 --> 00:01:06,330
and in other industrial
settings to collect,

23
00:01:06,330 --> 00:01:09,513
analyze, and share data in real time.

24
00:01:10,710 --> 00:01:14,490
Both IoT, Internet of Things, and IIoT,

25
00:01:14,490 --> 00:01:18,330
Industrial Internet of
Things, have four components.

26
00:01:18,330 --> 00:01:20,310
They have an embedded system.

27
00:01:20,310 --> 00:01:21,930
They have sensors.

28
00:01:21,930 --> 00:01:23,580
They have an actuator.

29
00:01:23,580 --> 00:01:25,563
And they have a wireless transceiver.

30
00:01:26,850 --> 00:01:28,080
Remember that an embedded system,

31
00:01:28,080 --> 00:01:30,030
we talked about this in the last lesson,

32
00:01:30,030 --> 00:01:32,640
includes a microprocessor, an RTOS,

33
00:01:32,640 --> 00:01:34,410
real-time operating system,

34
00:01:34,410 --> 00:01:37,500
and software designed to
perform a specific task.

35
00:01:37,500 --> 00:01:41,160
And that microprocessor we
refer to really as a SOC,

36
00:01:41,160 --> 00:01:42,303
a system on a chip.

37
00:01:43,470 --> 00:01:46,500
A center is a component that
detects and responds to changes

38
00:01:46,500 --> 00:01:47,450
in the environment.

39
00:01:48,690 --> 00:01:50,850
An actuator is a component
that takes the electrical input

40
00:01:50,850 --> 00:01:53,370
and turns it into a physical action.

41
00:01:53,370 --> 00:01:56,130
And a wireless transceiver
is a component that can send

42
00:01:56,130 --> 00:01:58,650
and receive radio frequency, that's RF,

43
00:01:58,650 --> 00:01:59,790
signals over the air.

44
00:01:59,790 --> 00:02:01,950
Now it could be NFC,
near field communication,

45
00:02:01,950 --> 00:02:05,883
WLAN, RFID, or GSM, in this case cellular.

46
00:02:08,640 --> 00:02:12,420
So, let's look at some
IoT and IIoT examples.

47
00:02:12,420 --> 00:02:17,250
Wearables, IoT enables fitness
trackers and smart watches,

48
00:02:17,250 --> 00:02:20,190
right, that can monitor
various health metrics such

49
00:02:20,190 --> 00:02:23,160
as your heart rate and
provide all kinds of insights

50
00:02:23,160 --> 00:02:25,440
to help people make informed decisions

51
00:02:25,440 --> 00:02:27,183
about their health and wellness.

52
00:02:28,020 --> 00:02:30,030
We have IoT devices in our homes,

53
00:02:30,030 --> 00:02:32,490
so we can have smart
homes, smart thermostats,

54
00:02:32,490 --> 00:02:35,070
smart lighting, smart security systems,

55
00:02:35,070 --> 00:02:36,960
which allow homeowners to control

56
00:02:36,960 --> 00:02:39,513
and automate their home
systems automatically.

57
00:02:40,830 --> 00:02:44,760
In the IIoT world, we've got
things like smart agriculture.

58
00:02:44,760 --> 00:02:46,920
IIoT sensors are used in agriculture

59
00:02:46,920 --> 00:02:48,690
to monitor soil moisture,

60
00:02:48,690 --> 00:02:51,360
temperature, and other
environmental factors

61
00:02:51,360 --> 00:02:54,540
to optimize crop yield,
reduce water usage,

62
00:02:54,540 --> 00:02:56,193
and increase efficiency.

63
00:02:57,210 --> 00:02:59,010
And in an industrial setting, right,

64
00:02:59,010 --> 00:03:02,460
manufacturing to monitor
and optimize processes,

65
00:03:02,460 --> 00:03:05,763
improve efficiency,
and to reduce downtime.

66
00:03:09,300 --> 00:03:11,490
I want to next introduce
you to the concept

67
00:03:11,490 --> 00:03:16,490
of edge computing and how it
interacts with IoT or IIoT.

68
00:03:16,680 --> 00:03:20,010
Edge computing is a deployment
of data handling activities

69
00:03:20,010 --> 00:03:22,800
and operations at or close to the source

70
00:03:22,800 --> 00:03:26,550
without having to go through
centralized network segments.

71
00:03:26,550 --> 00:03:27,750
Now depending on the device,

72
00:03:27,750 --> 00:03:29,700
or the equipment being considered,

73
00:03:29,700 --> 00:03:31,770
that network edge can refer to the area

74
00:03:31,770 --> 00:03:34,890
where the device communicates
with the internet.

75
00:03:34,890 --> 00:03:39,540
So, for IIoT or IoT devices,
such as a smart camera,

76
00:03:39,540 --> 00:03:42,660
with the network edge will
actually be the processor

77
00:03:42,660 --> 00:03:44,310
within the camera.

78
00:03:44,310 --> 00:03:47,400
Now, smart edge devices are equipped

79
00:03:47,400 --> 00:03:51,300
with features for capturing
data and processing.

80
00:03:51,300 --> 00:03:52,650
So, this all sounds great, right?

81
00:03:52,650 --> 00:03:54,930
We've been talking about embedded systems,

82
00:03:54,930 --> 00:03:58,020
ICS systems and its SCADA systems,

83
00:03:58,020 --> 00:04:01,710
and now IoT systems and IIoT systems.

84
00:04:01,710 --> 00:04:04,320
Is there anything that we
should be worried about?

85
00:04:04,320 --> 00:04:07,920
Well, there's a lot of
IoT vulnerabilities.

86
00:04:07,920 --> 00:04:10,470
IoT devices are vulnerable largely

87
00:04:10,470 --> 00:04:14,070
because the devices lack really

88
00:04:14,070 --> 00:04:16,230
often built-in security controls

89
00:04:16,230 --> 00:04:19,410
and configures to counter threats.

90
00:04:19,410 --> 00:04:20,820
Now, why is that?

91
00:04:20,820 --> 00:04:23,640
Well because very often
there's a rush to market.

92
00:04:23,640 --> 00:04:26,490
Right, when an IoT device
is being developed,

93
00:04:26,490 --> 00:04:27,990
it's let's get it out there,

94
00:04:27,990 --> 00:04:31,260
let's get it to market with
a focus on marketability,

95
00:04:31,260 --> 00:04:34,680
focus on price, focus on usability,

96
00:04:34,680 --> 00:04:36,660
focus on being first to market,

97
00:04:36,660 --> 00:04:41,010
and very often with an
afterthought, if any, right,

98
00:04:41,010 --> 00:04:42,030
about security.

99
00:04:42,030 --> 00:04:45,570
So, IoT devices are certainly a concern.

100
00:04:45,570 --> 00:04:48,270
Now, the nice thing is IoT devices

101
00:04:48,270 --> 00:04:50,550
because they're specifically designed

102
00:04:50,550 --> 00:04:52,800
not to be in a home
environment or personal use,

103
00:04:52,800 --> 00:04:55,860
but to be in an industrial
or corporate environment,

104
00:04:55,860 --> 00:04:59,760
generally will have more
attention paid to security

105
00:04:59,760 --> 00:05:01,980
and will have more security options.

106
00:05:01,980 --> 00:05:03,810
Now, some common vulnerabilities

107
00:05:03,810 --> 00:05:06,680
that you should be watching
out for whether it's IoT,

108
00:05:06,680 --> 00:05:09,510
or IoT include firmware vulnerabilities

109
00:05:09,510 --> 00:05:12,450
which really is an embedded device issue,

110
00:05:12,450 --> 00:05:14,880
default or weak passwords, right,

111
00:05:14,880 --> 00:05:17,880
so are you still using
the default password?

112
00:05:17,880 --> 00:05:18,843
Can you change it?

113
00:05:19,850 --> 00:05:21,570
I hope you can or is
it just a weak password

114
00:05:21,570 --> 00:05:24,690
maybe single factor just you
know can't do anything else

115
00:05:24,690 --> 00:05:26,040
to enhance it?

116
00:05:26,040 --> 00:05:27,840
A lack of encryption?

117
00:05:27,840 --> 00:05:29,790
The use of insecure protocols,

118
00:05:29,790 --> 00:05:33,060
so example using Telnet
instead of using SSH.

119
00:05:33,060 --> 00:05:35,340
A lack of security updates.

120
00:05:35,340 --> 00:05:38,820
Minimal, if any, logging
and alerting capabilities.

121
00:05:38,820 --> 00:05:40,800
And then of course supply chain attacks,

122
00:05:40,800 --> 00:05:44,340
including introducing malicious code.

123
00:05:44,340 --> 00:05:47,340
Because when we're
thinking about IoT or IIoT,

124
00:05:47,340 --> 00:05:49,680
I always want you to remember
that we're also talking

125
00:05:49,680 --> 00:05:52,260
about an embedded system.

126
00:05:52,260 --> 00:05:55,530
And that, my friends, brings
us to a three-second challenge.

127
00:05:55,530 --> 00:05:57,840
Five challenge questions,
three seconds each.

128
00:05:57,840 --> 00:05:58,673
Let's do it.

129
00:05:59,790 --> 00:06:01,470
Component that detects and responds

130
00:06:01,470 --> 00:06:03,990
to changes in the environment.

131
00:06:03,990 --> 00:06:05,583
One, two, three.

132
00:06:06,780 --> 00:06:07,713
That's a sensor.

133
00:06:09,090 --> 00:06:13,083
Number two, commercial
application of IoT technology.

134
00:06:14,340 --> 00:06:16,680
One, two, three.

135
00:06:16,680 --> 00:06:18,240
That's going to be IoT,

136
00:06:18,240 --> 00:06:20,403
or the Industrial Internet of Things.

137
00:06:23,130 --> 00:06:27,270
Number three, the device
that's able to connect, share,

138
00:06:27,270 --> 00:06:29,313
and interact with its user.

139
00:06:30,870 --> 00:06:32,793
One, two, three.

140
00:06:33,720 --> 00:06:36,063
That's referred to as a smart device.

141
00:06:37,080 --> 00:06:40,323
Number four, components
of an embedded system.

142
00:06:41,640 --> 00:06:42,810
One, two, three.

143
00:06:42,810 --> 00:06:44,760
Remember, there are three components.

144
00:06:44,760 --> 00:06:46,710
One, two, three.

145
00:06:46,710 --> 00:06:49,140
We have a system on a chip, SoC.

146
00:06:49,140 --> 00:06:51,840
We have an RTOS, it's a
real-time operating system.

147
00:06:51,840 --> 00:06:53,973
And then we have the application software.

148
00:06:55,080 --> 00:06:57,570
And lastly, number five,

149
00:06:57,570 --> 00:07:00,270
component that sends
and receives RF signals

150
00:07:00,270 --> 00:07:02,010
over the air.

151
00:07:02,010 --> 00:07:04,440
One, two, three.

152
00:07:04,440 --> 00:07:06,740
And that's going to be
a wireless transceiver.

153
00:07:08,340 --> 00:07:09,173
All right, my friends,

154
00:07:09,173 --> 00:07:10,920
that brings us to a security in action,

155
00:07:10,920 --> 00:07:12,090
so we can apply our knowledge.

156
00:07:12,090 --> 00:07:15,840
And this one's about
smart buildings, IIoT.

157
00:07:15,840 --> 00:07:18,810
Your organization is
building a new data center,

158
00:07:18,810 --> 00:07:22,410
and we're exploring IIoT
smart building options,

159
00:07:22,410 --> 00:07:27,410
including smart lighting, smart
doors, and smart elevators.

160
00:07:27,510 --> 00:07:30,360
Now, you've been asked to be
on the exploratory task force,

161
00:07:30,360 --> 00:07:33,180
and have volunteered to create a checklist

162
00:07:33,180 --> 00:07:36,480
for evaluating products and vendors.

163
00:07:36,480 --> 00:07:38,310
So, what are you gonna include?

164
00:07:38,310 --> 00:07:41,160
And so, we've got this new
data center being built.

165
00:07:41,160 --> 00:07:43,560
You want it to be a really
cool smart building,

166
00:07:43,560 --> 00:07:46,200
an IIoT smart building.

167
00:07:46,200 --> 00:07:49,380
It's gonna have smart
lighting, have smart doors.

168
00:07:49,380 --> 00:07:51,453
It's going to have smart elevators.

169
00:07:53,310 --> 00:07:54,840
and this exploratory task force,

170
00:07:54,840 --> 00:07:57,600
because this is a whole new thing, right?

171
00:07:57,600 --> 00:08:01,020
You're on, and you volunteered
to create this checklist.

172
00:08:01,020 --> 00:08:03,450
This is, okay, when we start
evaluating our products,

173
00:08:03,450 --> 00:08:05,880
smart lighting, smart
doors, smart elevators,

174
00:08:05,880 --> 00:08:07,950
what should we look at
in terms of the products

175
00:08:07,950 --> 00:08:08,823
and the vendors?

176
00:08:09,859 --> 00:08:11,820
So put me on pause. Go ahead
and write up a little checklist

177
00:08:11,820 --> 00:08:13,350
of what you would include.

178
00:08:13,350 --> 00:08:14,183
And come on back,

179
00:08:14,183 --> 00:08:15,773
and we'll go through them together.

180
00:08:18,510 --> 00:08:21,090
Well, let's start at the
top, our supply chain, right.

181
00:08:21,090 --> 00:08:23,130
We wanna know what is the source

182
00:08:23,130 --> 00:08:25,170
of the embedded chips and software.

183
00:08:25,170 --> 00:08:26,640
Where did they come from?

184
00:08:26,640 --> 00:08:28,470
Because we're really
concerned about those chips.

185
00:08:28,470 --> 00:08:31,470
We wanna make sure that the
old chips aren't being used,

186
00:08:31,470 --> 00:08:32,670
that chips that have known

187
00:08:32,670 --> 00:08:35,460
vulnerabilities aren't being used,

188
00:08:35,460 --> 00:08:38,490
maybe chips that can't be
upgraded aren't being used,

189
00:08:38,490 --> 00:08:42,540
as well as the software, the
operating system software,

190
00:08:42,540 --> 00:08:43,980
the RTOS.

191
00:08:43,980 --> 00:08:45,000
Is it open source?

192
00:08:45,000 --> 00:08:47,010
What kind of open source is it?

193
00:08:47,010 --> 00:08:48,450
How old is it, right?

194
00:08:48,450 --> 00:08:50,850
So, we really want to
understand, you know,

195
00:08:50,850 --> 00:08:54,090
where is the embedded chips
and the software coming from?

196
00:08:54,090 --> 00:08:56,640
And that's going to be
going down our supply chain.

197
00:08:57,750 --> 00:08:59,160
We want to be asking questions

198
00:08:59,160 --> 00:09:01,530
about what's the available
security controls

199
00:09:01,530 --> 00:09:05,970
for authentication, encryption,
visibility, or monitoring.

200
00:09:05,970 --> 00:09:07,860
And how about patch management in terms

201
00:09:07,860 --> 00:09:09,693
of any firmware updates?

202
00:09:11,670 --> 00:09:13,770
We want to look at privacy controls,

203
00:09:13,770 --> 00:09:15,840
about what data is gonna be shared,

204
00:09:15,840 --> 00:09:17,100
because data is gonna be collected.

205
00:09:17,100 --> 00:09:19,563
So, what data is gonna
be shared and with whom?

206
00:09:20,610 --> 00:09:24,210
Security testing, both what
the vendor has already done

207
00:09:24,210 --> 00:09:27,900
and what your organization
can do to test the security

208
00:09:27,900 --> 00:09:29,223
of these devices.

209
00:09:31,380 --> 00:09:32,520
And then we want to research,

210
00:09:32,520 --> 00:09:35,790
and review all available
vulnerability intelligence,

211
00:09:35,790 --> 00:09:40,790
and compromise history related
to both the IoT devices,

212
00:09:41,160 --> 00:09:43,230
and to that vendor.

213
00:09:43,230 --> 00:09:45,000
Being able to create
this kind of checklist

214
00:09:45,000 --> 00:09:46,260
and then going ahead and doing it,

215
00:09:46,260 --> 00:09:48,210
that's really cool stuff
because you're gonna move

216
00:09:48,210 --> 00:09:52,980
your organization into the
next generation of buildings.

217
00:09:52,980 --> 00:09:54,780
But we always want to be cognizant

218
00:09:54,780 --> 00:09:58,260
of the potential vulnerabilities
and security issues.

219
00:09:58,260 --> 00:10:00,360
And by understanding them better

220
00:10:00,360 --> 00:10:02,700
and really putting our
requirements in place,

221
00:10:02,700 --> 00:10:06,240
that allows us to minimize
the risk to our organization.

222
00:10:06,240 --> 00:10:09,570
And doing that, well, that's
definitely security in action.

223
00:10:09,570 --> 00:10:10,770
There's your word cloud.

224
00:10:12,000 --> 00:10:12,833
It's not too big,

225
00:10:13,729 --> 00:10:15,450
but make sure you know all
of these before you move on.

226
00:10:15,450 --> 00:10:18,690
And what we're going to move
on to is a 10-question quiz.

227
00:10:18,690 --> 00:10:19,840
So, I'll see you there.