BROADCASTS.com

All links and images for this episode can be found on CISO Series (https://cisoseries.com/defense-in-depth:-internet-of-things/)

When Internet of Things or IoT devices first came onto the market, security wasn't even a thought, let alone an afterthought. Now we're flooded with devices with no security and their openness and connectivity are being used to launch malicious attacks. What are methods to secure environments today and how should these IoT devices being secured in the future?

Check out this post\xa0for the discussion that is the basis of our conversation on this week\u2019s episode co-hosted by me,\xa0David Spark\xa0(@dspark), the producer of\xa0CISO Series\xa0and\xa0Allan Alford\xa0(@AllanAlfordinTX).\xa0Our guest is Josh Corman (@joshcorman), founder of I\xa0Am\xa0The\xa0Cavalry.

Thanks to this week\u2019s podcast sponsor, Pulse Secure.

Pulse\xa0Secure\xa0offers easy, comprehensive solutions that provide visibility and seamless, protected connectivity for hybrid IT in a Zero Trust world. Over 20,000 enterprises entrust\xa0Pulse\xa0Secure\xa0to empower their mobile workforce to securely access applications and information in the data center and cloud while ensuring business compliance.

• For years, manufacturers didn't consider device security. As a result, attackers have used insecure devices like connected webcams to gain entry into a corporate network.
• If you're manufacturing devices, then make security and patches a top concern even after end of life support.
• Big gap between public trust and the reality. Almost all people trust manufacturers to secure their devices. The reality is most manufacturers aren't securing their devices.
• While we've seen webcams used to launch distributed denial of service (DDoS) attacks, the greatest concern is of a similar style attack being launched against industrial IoT.
• The discussion of IoT security goes beyond security of devices. We know there are devices with zero security connected to our network. This is where a larger discussion of zero trust and defense in depth style security programming comes into play.
• We have a growing number of unmanaged devices. Devices that are just always on and connected to the Internet providing simple functions like reading their environment.
• How much responsibility do manufacturers have for the security of their devices after they've been purchased and shipped? They can create updates and patches, but they can't enforce them.