SlideShare a Scribd company logo
KNOW YOUR IoT
SECURITY RISK
How Hackable
is Your Smart
Enterprise?
ForeScout IoT Enterprise
Risk Report explores
common IoT devices
that make organizations
vulnerable to dangerous –
if not disastrous – attacks.
IoT is here to stay, but the proliferation and
ubiquity of these devices in the enterprise is
creating a much larger attack surface and
easy entry points for hackers to gain access
to the network. The solution starts with
real-time, continuous visibility and control
of devices the instant they connect -- you
cannot secure what you cannot see.
Michael DeCesare, ForeScout President & CEO
connected devices
are in use
today globally(a)
6.4
BILLION
BY 2018,
two thirds of enterprises will
experience IoT security breaches (c)
20
BILLION
The number
of connected
devices will
reach more than
by 2020 (a)
65%
of enterprises have
actively deployed
IoT technologies
as of June 2016 (b)
RESEARCH OVERVIEW
ForeScout IoT
Enterprise Risk Report
Industry attention has narrowed in on the threat of commonly
known Internet of Things (IoT) devices and their potential safety
implications to the home, but there is as much, if not more, to
consider when exploring IoT threats in the enterprise.
Research into seven common enterprise IoT devices revealed
that their core technologies, fundamental development methods
and rapid production makes implementing proper security
within the software, firmware and hardware a complex,
overlooked and often neglected task.

Recommended for you

IOT Security
IOT SecurityIOT Security
IOT Security

A look at the main security risks and impact related to IOT devices as well as what are the key steps to improve IOT security.

iotcyber securitybest practises
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)

Network Access Control is used to control access to enterprise networks. Mobile Device Management is used to manage and secure mobile devices. Put them together and your customers can set network access policies based on knowledge of the device - the Power of Two! Forescout is global leader in NAC. MobileIron is global leader in MDM/MCM/MAM and Secure Mobile IT.

20132014data
Next-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space AgeNext-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space Age

Space infrastructure has become an integral part of everyday life, with individuals, businesses and governments relying overwhelmingly on it. However, despite the space industry’s technical sophistication, its cybersecurity efforts have lagged behind that of other high-tech sectors. Block Armour has developed a next-gen Zero Trust Cybersecurity solution explicitly designed for connected devices, integrated IoT systems and related communication networks. And, is extending the solution to deliver Zero Trust Cybersecurity for Software-defined Space based Systems.

aerospaceblockchaincybersecurity
The identified seven IoT devices can be hacked in as little as three minutes,
but can take days or weeks to remediate.
Should any of these devices become infected, hackers can plant backdoors to
create and launch an automated IoT botnet DDoS attack.
Cybercriminals can leverage jamming or spoofing techniques to hack smart
enterprise security systems, enabling them to control motion sensors, locks
and surveillance equipment.
With VoIP phones, exploiting configuration settings to evade authentication
can open opportunities for snooping and recording of calls.
Via connected HVAC systems and energy meters, hackers can force critical
rooms (for example, server rooms) to overheat critical infrastructure and
ultimately cause physical damage.
Key Findings
DISASTROUS
Could cause irreversible
damage, invade user
privacy, gain access to
private corporate
information or destroy
critical equipment.
DISRUPTIVE
Can disrupt corporate
and operational
processes.
DAMAGING
Would allow snooping
around a corporate
network or extracting
private credentials.
IP-Connected
Security Systems
IP-Connected Infrastructure:
Climate Control &
Energy Meters
Smart Video
Conferencing Systems
Connected
Printers
VoIP
Phones
Smart
Fridges
Smart
Lightbulbs
Danger Rankings
When successfully hacked, all of these devices are a gateway into the broader
enterprise network. Breaking it down even further, IoT hacks can lead to:
Danger Scenarios
Snooping
on calls
Accessing
private company
and user
information
Spying via video
and microphone
Disabling to
allow physical
break-ins
Tampering with
temperature controls
and destroying
critical equipment
Obtaining
user
credentials
Extracting Wi-Fi
credentials to carry
out further attacks
EXPLORING SEVEN COMMON IoT DEVICES
Where Do The
Vulnerabilities Lie?

Recommended for you

Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems

Since, IoT systems of interrelated computing devices, mechanical or digital machines, which enables data transfer over a network without requiring human to human or human to computer interaction. So these are top 7 security measures which are most effective in order to enhance productivity for delivering better customer experience by minimizing the operational costs.

#securitytestingcompany#securitytestingservices#softwaretestingservices
Iot(security)
Iot(security)Iot(security)
Iot(security)

the ppt describes about the basics of iot,its applications, security challenges , hacks and the solutions to the security challenges

Physical/Network Access Control
Physical/Network Access ControlPhysical/Network Access Control
Physical/Network Access Control

Make presence in a building or area a policy in accessing network resources by integrating physical and network access through the Trusted Computing Group's IF-MAP communications standard.

neywork access controlif-maptrusted computing
Many use proprietary
radio frequency
technology that
lacks authentication
and encryption to
communicate. They also
have dependencies on
some cloud services
and are connected to
the internet.
Attackers can form
radio signals to send
false triggers and
access system controls.
Weak credentials can be
used as ‘bouncing off’ points
to attack other systems.
Most use radio signals
that are easy to detect
and fail to employ
frequency hopping
techniques, leaving
them open to jamming
and spoofing.
Jamming or spoofing an
enterprise security system
could allow criminals to
turn off motion sensors,
remotely open locks, or
redirect/switch off
surveillance equipment.
IoT DEVICE RISKS
IP-Connected Security Systems
Use wireless communication to connect with other smart devices
for easy entry and access, which can open the
floodgates for crafty hackers.
(See references page #1-3)
DISASTROUS
DISASTROUS
IoT DEVICE RISKS
IP-Connected Infrastructure:
Climate Control & Energy Meters
HVAC systems provide an avenue for hackers to gain network access.
Enterprises are also using smart electric meters to monitor
wireless energy – creating additional risk.
HVAC systems are
typically on the same
network that internal
systems are connected
to, which hackers
can easily access to
intercept data, escalate
privilege and carry out
further attacks.
Attackers can force
critical rooms (for example,
server rooms) to overheat
and cause physical damage.
Smart energy meters
can allow attackers to
alter the reported
energy levels of a
company - potentially
leading to fraudulent
accounting and
metering.
IP-connected
infrastructure uses wireless
technology that is often
accessible to anyone
within range.
(See references page #4)
(See references page #5-11)
Vulnerable to
exploits that allow
remote attackers to
control any of the apps
on the system, take
over social and
communication apps,
record audio and video.
Since they are wired
Ethernet or Wi-Fi
connected, hackers have
access to sensitive places
like boardrooms, C-Level
offices and conference
rooms that are not often
accessible by outside visitors.
Attackers have full access to all
software, memory and hardware,
exposing the microphone, camera
and stored credentials.
Similar to all software,
most use common
OSs, which have
significant overflow
vulnerabilities.
Buffer overflow allows the
Smart TV to be accessible
from behind a router or
firewall, exposing it to
intruders from anywhere
on the Internet.
Smart TVs connect to
the local network over
IP and also serve as a
pivot point for
hackers to gain full
network access.
Attackers can exploit other
systems on the network
entirely from a shell they’ve
compromised on the TV.
IoT DEVICE RISKS
Smart Video Conference Systems
Enable internet-based streaming, conference calling and
screen-sharing, often only requiring the click of a button for users
to share screens – and for hackers to commandeer it.
DISRUPTIVE
(See references page #12-21)
IoT DEVICE RISKS
Connected Printers
Nearly all printers are networked over IP, making them accessible
from virtually any computer on the network – and a welcome
mat to hackers to infiltrate the enterprise.
Without physical
access, hackers can
comprise printers to
siphon private
documents printed
through them.
This is almost undetectable
without proper security
and monitoring.
By accessing specially
crafted URLs that
evade authentication,
attackers can visit
pages that expose the
printer’s credentials.
If printers are on a public
network or attackers are
on the same Wi-Fi
network, they can send a
specially crafted Simple
Network Management
Protocol (SNMP) packet
to obtain the admin
password, and gain full
control of the printer.
Many exploitable issues
are are not resolvable
without updates to
firmware or an intrusion
detection system.
DISRUPTIVE

Recommended for you

IoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 finalIoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 final

This document discusses Internet of Things (IoT) security. It defines IoT as interconnecting physical devices via communication technologies. It categorizes IoT devices and lists common technology vendors. It then describes why IoT devices are vulnerable in terms of cost, processing power, history of neglecting security, proprietary technologies, and inability to update. Examples of IoT attacks are also provided such as using webcams for DDoS attacks and hacking home routers and cars. The document concludes with recommended countermeasures like leveraging existing frameworks, segmentation, not relying on users, and building in automatic updates.

Internet of Things Security Patterns
Internet of Things Security PatternsInternet of Things Security Patterns
Internet of Things Security Patterns

Presented at Internet of Things Stream Conference 2015 in San Francisco by Mark Benson on April 2nd, 2015. ABSTRACT: The growth of IoT is occurring at an incredible rate, justly raising alarms about security and privacy issues as we become increasingly reliant on these intelligent, interconnected devices in our lives and businesses. How are we to protect billions of devices from attacks and intrusions that could compromise our personal privacy, public safety, or business viability? Building an IoT solution involves securing sensors, devices, networks, cloud platforms, web applications, and mobile applications for diverse industries. This presentation examines the landscape of emerging security challenges posed by connected devices and offers a catalog of security deployment patterns that have been successfully used by some of the world’s most well known OEMs to deploy connected product fleets.

iotindustrial automationsecurity
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...

Due to the #covid19 pandemic, organizations were faced with an unprecedented, novel challenge of ensuring business continuity without endangering employee health and safety. Presenting our latest case study about how we enabled secure remote access to on-premise as well as SaaS applications for the employees of a Fortune 500 Oil and Gas firm subsidiary with minimal changes in their existing IT environment.

zerotrustcybersecurityblockchain
Complex routing
exposes phones
to remote snooping
and some can be
activated as a
speakerphone with
no visible indication.
Hackers can exploit
configuration settings
to evade authentication
and then update the
phone, allowing them
to listen to phone
conversations or
make calls.
Attackers only need
to know the IP address
of the phone to be
able to access it.
IoT DEVICE RISKS
VoIP Phones
VoIP phones leverage the network for many sophisticated
features that makes communication easy, not only for
employees – but also malicious hackers.
(See references page #22-23)
DISRUPTIVE
(See references page #24)
Due to lax certificate
checking, attackers
on the same network
could conduct a MITM
(man-in-the-middle)
attack to intercept
communication and
modify traffic between
a client and server.
This can be done by
injecting spoofed
Address Resolution
Protocol (ARP) requests or
Domain Name System
(DNS) responses, both of
which are critical to IP
networks today and provide
no method of authentication
or encryption.
This grants attackers
access to any of the
integrated enterprise
applications, and the user
credentials associated
with that account.
IoT DEVICE RISKS
Smart Fridges
Wi-Fi-enabled refrigerators with LCD screens have access to widely
used operational apps (such as scheduling applications, calendars and
notification systems) and the credentials stored within.
DAMAGING
(See references page #25-27)
Mesh network
communication
channels can be
sniffed by attackers.
By sniffing the network,
attackers only need to be
within Wi-Fi range of the
smart bulb with no original
access to the network.
Hackers can extract
password-protected
Wi-Fi credentials without
being on the network,
allowing them to gain access
to other systems and devices
in the enterprise – from
laptops to smartphones and
even network-connected
manufacturing systems.
Some bulbs have been shown to
send Wi-Fi credentials in plain text,
making extraction possible.
IoT DEVICE RISKS
Smart Lightbulbs
Smart lightbulbs operate on Wi-Fi and proprietary mesh networks –
they can easily integrate into other connected systems that
can be controlled by external devices and hackers.
DAMAGING
IoT threats could
spread through
networks and
the internet.
If a threat were to
successfully infect a
device and infiltrate one
network, it could spread
to an entirely separate,
segregated network - just
by being within wireless
range of another IoT
device, despite no
previous communication
between the two.
IoT threats would work even more
effectively by targeting the
specialized wireless communication
protocols that IoT devices share,
such as Wi-Fi, Bluetooth, ZigBee.
Anatomy of an IoT Attack

Recommended for you

Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...

Global Network Access Control Market was estimated over USD 551.6 million in 2014 and is anticipated to be worth USD 4.39 billion by 2022, with a CAGR at 30.2%. Increasing rate of data thefts and cyber-attacks have resulted in the development of Network Access Control that provide solution to combat these problems. NAC solutions have been accepted on a large scale at a rapid pace in order to ensure safety from malware attacks, hackers and malicious software thereby leading to a need for secure network infrastructure.

network access control marketnetwork access control market trendstechnology
SCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber GriefSCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber Grief

Every time a new information technology finds its way into production, it seems as though we end up repeating the same process – security vulnerabilities will be discovered and disclosed in that technology, and users and vendors will deny that the risks are significant. Only after major attacks occur do we really start to see efforts to address the inherent risks in a systematic way. We’re falling into this exact same trap again with Industrial Control and SCADA systems, but in this case the problem is worse, because the inherent nature of control systems prevents us from applying many of the strategies that have been used to protect other kinds of computer networks. Join Lancope’s Director of Security Research, Tom Cross, for a look at the five stages of grief that organizations seem to pass through as they come to terms with security risks, and how far we’ve come regarding Industrial Control Systems. Hear about: The state of Control Systems security vulnerabilities Attack activity that is prompting a change in perspective The unique, long-term challenges associated with protecting SCADA networks How anomaly detection can play a key role in protecting SCADA systems now

security intelligencenetflowstealthwatch
NAC Solution Taarak
NAC Solution TaarakNAC Solution Taarak
NAC Solution Taarak

The document summarizes the CounterACT security platform which provides network visibility, access control, and compliance capabilities. It can detect all devices on a network, control user access based on policies, and help maintain regulatory compliance. The platform offers non-disruptive deployment, scalability for all network sizes, and easy management through a centralized console.

Visualizing an IoT Attack
Research Methodology
Commissioned by ForeScout Technologies, the IoT Enterprise Risk Report
employed the skills of Samy Kamkar, one of the world’s leading ethical
hackers, to investigate the security risks posed by IoT devices in enterprise
environments. The report sought to uncover vulnerabilities in
enterprise-grade technology, utilizing both physical testing situations,
as well as drawing from peer-reviewed industry research.
Kamkar conducted extensive research (including reviewing datasheets,
previous hacks, peer-reviewed/industry research, known CVEs and first-hand
conversations with industry peers) to evaluate each device, looking into
vulnerabilities of the following: inputs, outputs, physical ports, communication
protocols, manufacturing techniques and software and/or firmware involved.
While IoT devices make it possible for organizations to run faster and more
efficiently, they are too often used with little regard to their security risk. The rush to
deliver new types of IoT technologies sacrifices security – almost 100 percent of the
time. Once these devices are on the network, it’s easy for malware to compromise
them, or for a hacker to gain access through them and steal critical information.
It’s a cybersecurity challenge and an opportunity to
help CISOs fill the ensuing security gaps.
Businesses need an agentless approach to be able to manage their IoT devices –
helping them to see the devices in real time. Enterprise IoT devices, some of which
were examined in this analysis, are not designed with security agents, and IT
departments often turn a blind eye when new devices are added to the corporate
network to avoid the hassle of re-deploying their security protections.
In the age of IoT, visibility and control of devices on the
network is a must have, not a nice to have.
Summary
Best Practices
IoT security starts with full visibility and control over devices
as soon as they connect to the corporate network.
DISCOVER AND
CLASSIFY
IoT devices the instant
they connect to the
network
CONTROL
network access based
on device type, posture
and behavior
ORCHESTRATE
integrate islands of
security; leverage existing
investments for better
protection

Recommended for you

IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process

Deral Heiland CISSP, serves as a the Research Lead (IoT) for Rapid7. Deral has over 20 years of experience in the Information Technology field, and has held multiple positions including: Senior Network Analyst, Network Administrator, Database Manager, Financial Systems Manager and Senior Information Security Analyst. Over the last 10+ years Deral’s career has focused on security research, security assessments, penetration testing, and consulting for corporations and government agencies. Deral also has conducted security research on a numerous technical subjects, releasing white papers, security advisories, and has presented the information at numerous national and international security conferences including Blackhat, Defcon, Shmoocon, DerbyCon, RSAC, Hack In Paris. Deral has been interviewed by and quoted by several media outlets and publications including ABC World News Tonight, BBC, Consumer Reports, MIT Technical Review, SC Magazine, Threat Post and The Register.

hackinghacking conferencehacker halted
Nac market
Nac marketNac market
Nac market

The NAC market is forecasted to grow substantially through 2018, reaching $1.46 billion. Top vendors currently control 70% of the market. Key drivers of NAC adoption include the ability to quarantine endpoints, support for BYOD, malware detection capabilities, ease of use, and integration with other security tools. The financial, government, healthcare, and education sectors account for 80% of NAC sales. NAC solutions must address challenges like interoperability, mobile workforce deployment, scalability, and streamlining IT operations like guest access and device management. The future of NAC involves more cohesive, distributed defenses that seamlessly integrate endpoint and perimeter security.

nac
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things

This document discusses security issues with Internet of Things (IoT) devices and proposes solutions. It summarizes the 2016 Mirai botnet attack that took down major websites. Default passwords allow the easy compromise of hundreds of thousands of IoT devices. Proposed solutions include network segmentation of IoT devices, internal firewalls, adopting a zero trust model, and consumers pressuring manufacturers to build more secure products. An IoT nutrition label is suggested to help consumers compare security. Overall the document analyzes current IoT vulnerabilities and strategies to address them.

iotinformation securitymalware
About ForeScout
ForeScout Technologies is transforming security through visibility.
ForeScout offers Global 2000 enterprises and government
organizations the unique ability to see devices, including
non-traditional devices, the instant they connect to the network.
Equally important, ForeScout lets you control these devices and orchestrate
information sharing and operation among disparate security tools to accelerate
incident response. Unlike traditional security alternatives, ForeScout achieves this
without requiring software agents or previous device knowledge. The company's
solutions integrate with leading network, security, mobility and IT management
products to overcome security silos, automate workflows and enable significant cost
savings. As of January 2016, more than 2,000 customers in over 60 countries
improve their network security and compliance posture with ForeScout solutions.
Learn more at ForeScout.com
© 2016. ForeScout Technologies, Inc. is a privately held Delaware corporation. ForeScout, the ForeScout logo, ControlFabric,
CounterACT Edge, ActiveResponse and CounterACT are trademarks or registered trademarks of ForeScout.
Other names mentioned may be trademarks of their respective owners.
Glossary
IoT
IP
VoIP
OS
SNMP
MITM
ARP
DNS
OT
IT
DDoS
Internet of Things
Internet Protocol
Voice Over Internet Protocol
Operating System
Simple Network Management Protocol
Man-in-the-Middle
Address Resolution Protocol
Domain Name System
Operational Technology
Information Technology
Distributed Denial of Service
References
a) Gartner Says 6.4 Billion Connected "Things" Will Be in Use in 2016,
Up 30 Percent From 2015," Gartner. 10 November 2015.
b) 451 Research: Today 65% of Enterprises Already Using Internet of
Things; Business Value found in Optimizing Operations and
Reducing Risk," 451 Research. 29 June 2016.
c) Gens, F. "Webcast: IDC’s global technology predictions for 2016," IDC.
4 November 2015.
1) Rose, A. and Ramsey, B. “Picking Bluetooth Low Energy Locks
from a Quarter Mile Away,” Merculite Security. 6 August 2016.
2) Jmaxxz, “Backdooring the Frontdoor.” 7 August 2015.
3) Fernandes, E., Jung, J. and Prakash, A, “Security Analysis of Emerging
Smart Home Applications,” In Proceedings of 37th IEEE Symposium
on Security and Privacy, May 2016.
4) “CVE-2016-4529,” CVE. 5 May 2016.
5) “Vulnerability Summary for CVE-2014-7911,” National Vulnerability
Database. 15 December 2014.
6) “CVE-2014-6041,” CVE. 1 September 2014.
7) Lee, S and Kim, S. “Hacking, Surveilling, and Deceiving Victims on
Smart TVs,” CIST. August 2013.
8) Grattafiori, A. “The Outer Limits: Hacking A Smart TV,”
iSEC Partners. 28 October 2013.
9) “CVE-2012-5958,” CVE. 21 November 2012.
10) Russon, M. “It's official, your smart TV can be hijacked: Malware is
holding viewers to ransom,” International Business Times.
12 January 2016.
11) Metzger, M. “Millions of smart TVs and remote control apps
vulnerable,” SC Magazine. 9 December 2015.
12) “Samsung Printer SNMP Hardcoded Community String
Authentication Bypass Vulnerability,” Acunetix. 25 March 2015.
13) “CVE-2015-1056,” CVE. 16 January 2015.
14) “CVE-2014-3111,” CVE. 29 April 2014.
15) “CVE-2013-4613,” CVE. 17 June 2013.
16) Costin, A. “Hacking printers: for fun and profit,” Hack.Lu. 2010.
17) “CVE-2013-2507,” CVE. 8 March 2013.
18) “CVE-2013-2670,” CVE. 22 March 2013.
19) “CVE-2013-2671,” CVE. 22 March 2013.
20) “CVE-2012-4964,” CVE. 17 September 2012.
21) “CVE-2012-4964,” CVE. 17 September 2012.
22) “Cisco Small Business SPA300 and SPA500 Series IP Phones
Unauthenticated Remote Dial Vulnerability,” Cisco. 15 March 2015.
23) “Polycom Configuration,” Free Switch. 20 July 2014.
24) Venda, P. “Hacking DefCon 23’s IoT Village Samsung fridge,”
Pen Test Partners. 18 August 2015.
25) Chapman, A. “Hacking into Internet Connected Light Bulbs,”
Context. 4 July 2014.
26) “LIFX Firmware release 1 February 2015,” LIFX. 1 February 2015.
27) Wakefield, J., “Smart LED light bulbs leak Wi-Fi passwords”,
BBC, 8 July 2014.

More Related Content

What's hot

Throughwave Day 2015 - ForeScout Automated Security Control
Throughwave Day 2015 - ForeScout Automated Security ControlThroughwave Day 2015 - ForeScout Automated Security Control
Throughwave Day 2015 - ForeScout Automated Security Control
Aruj Thirawat
 
Zero Trust Cybersecurity for Microsoft Azure Cloud
Zero Trust Cybersecurity for Microsoft Azure Cloud Zero Trust Cybersecurity for Microsoft Azure Cloud
Zero Trust Cybersecurity for Microsoft Azure Cloud
Block Armour
 
Solution: Block Armour Secure Remote Access for WFH
Solution: Block Armour Secure Remote Access for WFHSolution: Block Armour Secure Remote Access for WFH
Solution: Block Armour Secure Remote Access for WFH
Block Armour
 
IOT Security
IOT SecurityIOT Security
IOT Security
Sylvain Martinez
 
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
Andris Soroka
 
Next-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space AgeNext-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space Age
Block Armour
 
Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems
Zoe Gilbert
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
Shreya Pohekar
 
Physical/Network Access Control
Physical/Network Access ControlPhysical/Network Access Control
Physical/Network Access Control
jwpiccininni
 
IoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 finalIoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 final
Frank Siepmann
 
Internet of Things Security Patterns
Internet of Things Security PatternsInternet of Things Security Patterns
Internet of Things Security Patterns
Mark Benson
 
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...
Block Armour
 
Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...
natjordan6
 
SCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber GriefSCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber Grief
Lancope, Inc.
 
NAC Solution Taarak
NAC Solution TaarakNAC Solution Taarak
NAC Solution Taarak
Mohit8780
 
IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process
EC-Council
 
Nac market
Nac marketNac market
Nac market
Sumit Bhat
 
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things
Christopher Frenz
 
IoT Hardware Teardown, Security Testing & Control Design
IoT Hardware Teardown, Security Testing & Control DesignIoT Hardware Teardown, Security Testing & Control Design
IoT Hardware Teardown, Security Testing & Control Design
Priyanka Aash
 
Securing Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
Securing Smart Cities with Blockchain-enabled Zero Trust CybersecuitySecuring Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
Securing Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
Block Armour
 

What's hot (20)

Throughwave Day 2015 - ForeScout Automated Security Control
Throughwave Day 2015 - ForeScout Automated Security ControlThroughwave Day 2015 - ForeScout Automated Security Control
Throughwave Day 2015 - ForeScout Automated Security Control
 
Zero Trust Cybersecurity for Microsoft Azure Cloud
Zero Trust Cybersecurity for Microsoft Azure Cloud Zero Trust Cybersecurity for Microsoft Azure Cloud
Zero Trust Cybersecurity for Microsoft Azure Cloud
 
Solution: Block Armour Secure Remote Access for WFH
Solution: Block Armour Secure Remote Access for WFHSolution: Block Armour Secure Remote Access for WFH
Solution: Block Armour Secure Remote Access for WFH
 
IOT Security
IOT SecurityIOT Security
IOT Security
 
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
DSS ITSEC Webinars 2013 - Network Access Control + Mobile Security (Forescout)
 
Next-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space AgeNext-generation Zero Trust Cybersecurity for the Space Age
Next-generation Zero Trust Cybersecurity for the Space Age
 
Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems Top 7 Security Measures for IoT Systems
Top 7 Security Measures for IoT Systems
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
 
Physical/Network Access Control
Physical/Network Access ControlPhysical/Network Access Control
Physical/Network Access Control
 
IoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 finalIoT Security Briefing FBI 07 23-2017 final
IoT Security Briefing FBI 07 23-2017 final
 
Internet of Things Security Patterns
Internet of Things Security PatternsInternet of Things Security Patterns
Internet of Things Security Patterns
 
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...CASE STUDY: How Block Armour enabled  secure remote access to on- premise as ...
CASE STUDY: How Block Armour enabled secure remote access to on- premise as ...
 
Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...Network Access Control Market Trends, Technological Analysis and Forecast Rep...
Network Access Control Market Trends, Technological Analysis and Forecast Rep...
 
SCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber GriefSCADA Security: The Five Stages of Cyber Grief
SCADA Security: The Five Stages of Cyber Grief
 
NAC Solution Taarak
NAC Solution TaarakNAC Solution Taarak
NAC Solution Taarak
 
IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process
 
Nac market
Nac marketNac market
Nac market
 
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things
 
IoT Hardware Teardown, Security Testing & Control Design
IoT Hardware Teardown, Security Testing & Control DesignIoT Hardware Teardown, Security Testing & Control Design
IoT Hardware Teardown, Security Testing & Control Design
 
Securing Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
Securing Smart Cities with Blockchain-enabled Zero Trust CybersecuitySecuring Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
Securing Smart Cities with Blockchain-enabled Zero Trust Cybersecuity
 

Similar to ForeScout IoT Enterprise Risk Report

LIFT OFF 2017: IoT and MSS Deep Dive
LIFT OFF 2017: IoT and MSS Deep DiveLIFT OFF 2017: IoT and MSS Deep Dive
LIFT OFF 2017: IoT and MSS Deep Dive
Robert Herjavec
 
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
IJCSIS Research Publications
 
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
online Marketing
 
Chapter 3_Cyber Security-ccdf.pptx
Chapter 3_Cyber Security-ccdf.pptxChapter 3_Cyber Security-ccdf.pptx
Chapter 3_Cyber Security-ccdf.pptx
1SI19IS064TEJASS
 
Assign 1_8812814ctm.pptx
Assign 1_8812814ctm.pptxAssign 1_8812814ctm.pptx
Assign 1_8812814ctm.pptx
pdevang
 
A Quick Guide On What Is IoT Security_.pptx
A Quick Guide On What Is IoT Security_.pptxA Quick Guide On What Is IoT Security_.pptx
A Quick Guide On What Is IoT Security_.pptx
TurboAnchor
 
SmartSecuritySolution_for_IoT
SmartSecuritySolution_for_IoTSmartSecuritySolution_for_IoT
SmartSecuritySolution_for_IoT
Shiven Chawla
 
Best Practices for Cloud-Based IoT Security
Best Practices for Cloud-Based IoT SecurityBest Practices for Cloud-Based IoT Security
Best Practices for Cloud-Based IoT Security
SatyaKVivek
 
Secure your Future with IoT Security Testing | Application Security
Secure your Future with IoT Security Testing | Application SecuritySecure your Future with IoT Security Testing | Application Security
Secure your Future with IoT Security Testing | Application Security
Cigniti Technologies Ltd
 
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docxIoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
vrickens
 
Bolstering the security of iiot applications – how to go about it
Bolstering the security of iiot applications – how to go about it Bolstering the security of iiot applications – how to go about it
Bolstering the security of iiot applications – how to go about it
Moon Technolabs Pvt. Ltd.
 
Meletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
Meletis Belsis - Wireless Security: Common Protocols and VulnerabilitiesMeletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
Meletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
Meletis Belsis MPhil/MRes/BSc
 
The new era of Cyber Security IEC62443
The new era of Cyber Security IEC62443The new era of Cyber Security IEC62443
The new era of Cyber Security IEC62443
WoMaster
 
1.3-IoT Security Technologies (1).pdf
1.3-IoT Security Technologies (1).pdf1.3-IoT Security Technologies (1).pdf
1.3-IoT Security Technologies (1).pdf
TouhemiJamel
 
Security in IoT
Security in IoTSecurity in IoT
Security in IoT
SKS
 
WIRELESS DEFENSE STRATEGIES IN THE IOT ERA
WIRELESS DEFENSE STRATEGIES IN THE IOT ERAWIRELESS DEFENSE STRATEGIES IN THE IOT ERA
WIRELESS DEFENSE STRATEGIES IN THE IOT ERA
Aharon Aharon
 
An Internet of Things Reference Architecture
An Internet of Things Reference Architecture An Internet of Things Reference Architecture
An Internet of Things Reference Architecture
Symantec
 
beware of Thing Bot
beware of Thing Botbeware of Thing Bot
beware of Thing Bot
Bellaj Badr
 
CS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptxCS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptx
GaytriDhingra1
 
Final Research Project - Securing IoT Devices What are the Challe.docx
Final Research Project - Securing IoT Devices What are the Challe.docxFinal Research Project - Securing IoT Devices What are the Challe.docx
Final Research Project - Securing IoT Devices What are the Challe.docx
tjane3
 

Similar to ForeScout IoT Enterprise Risk Report (20)

LIFT OFF 2017: IoT and MSS Deep Dive
LIFT OFF 2017: IoT and MSS Deep DiveLIFT OFF 2017: IoT and MSS Deep Dive
LIFT OFF 2017: IoT and MSS Deep Dive
 
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
The Sharp Increase in Unmasking of Obtrusion into Internet of Things (IoT) IP...
 
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
12 IoT Cyber Security Threats to Avoid - CyberHive.pdf
 
Chapter 3_Cyber Security-ccdf.pptx
Chapter 3_Cyber Security-ccdf.pptxChapter 3_Cyber Security-ccdf.pptx
Chapter 3_Cyber Security-ccdf.pptx
 
Assign 1_8812814ctm.pptx
Assign 1_8812814ctm.pptxAssign 1_8812814ctm.pptx
Assign 1_8812814ctm.pptx
 
A Quick Guide On What Is IoT Security_.pptx
A Quick Guide On What Is IoT Security_.pptxA Quick Guide On What Is IoT Security_.pptx
A Quick Guide On What Is IoT Security_.pptx
 
SmartSecuritySolution_for_IoT
SmartSecuritySolution_for_IoTSmartSecuritySolution_for_IoT
SmartSecuritySolution_for_IoT
 
Best Practices for Cloud-Based IoT Security
Best Practices for Cloud-Based IoT SecurityBest Practices for Cloud-Based IoT Security
Best Practices for Cloud-Based IoT Security
 
Secure your Future with IoT Security Testing | Application Security
Secure your Future with IoT Security Testing | Application SecuritySecure your Future with IoT Security Testing | Application Security
Secure your Future with IoT Security Testing | Application Security
 
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docxIoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
IoT Referenceshttpswww.techrepublic.comarticlehow-to-secur.docx
 
Bolstering the security of iiot applications – how to go about it
Bolstering the security of iiot applications – how to go about it Bolstering the security of iiot applications – how to go about it
Bolstering the security of iiot applications – how to go about it
 
Meletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
Meletis Belsis - Wireless Security: Common Protocols and VulnerabilitiesMeletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
Meletis Belsis - Wireless Security: Common Protocols and Vulnerabilities
 
The new era of Cyber Security IEC62443
The new era of Cyber Security IEC62443The new era of Cyber Security IEC62443
The new era of Cyber Security IEC62443
 
1.3-IoT Security Technologies (1).pdf
1.3-IoT Security Technologies (1).pdf1.3-IoT Security Technologies (1).pdf
1.3-IoT Security Technologies (1).pdf
 
Security in IoT
Security in IoTSecurity in IoT
Security in IoT
 
WIRELESS DEFENSE STRATEGIES IN THE IOT ERA
WIRELESS DEFENSE STRATEGIES IN THE IOT ERAWIRELESS DEFENSE STRATEGIES IN THE IOT ERA
WIRELESS DEFENSE STRATEGIES IN THE IOT ERA
 
An Internet of Things Reference Architecture
An Internet of Things Reference Architecture An Internet of Things Reference Architecture
An Internet of Things Reference Architecture
 
beware of Thing Bot
beware of Thing Botbeware of Thing Bot
beware of Thing Bot
 
CS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptxCS_UNIT 2(P3).pptx
CS_UNIT 2(P3).pptx
 
Final Research Project - Securing IoT Devices What are the Challe.docx
Final Research Project - Securing IoT Devices What are the Challe.docxFinal Research Project - Securing IoT Devices What are the Challe.docx
Final Research Project - Securing IoT Devices What are the Challe.docx
 

Recently uploaded

Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
BookNet Canada
 
The Rise of Supernetwork Data Intensive Computing
The Rise of Supernetwork Data Intensive ComputingThe Rise of Supernetwork Data Intensive Computing
The Rise of Supernetwork Data Intensive Computing
Larry Smarr
 
The Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU CampusesThe Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU Campuses
Larry Smarr
 
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
Bert Blevins
 
Recent Advancements in the NIST-JARVIS Infrastructure
Recent Advancements in the NIST-JARVIS InfrastructureRecent Advancements in the NIST-JARVIS Infrastructure
Recent Advancements in the NIST-JARVIS Infrastructure
KAMAL CHOUDHARY
 
Manual | Product | Research Presentation
Manual | Product | Research PresentationManual | Product | Research Presentation
Manual | Product | Research Presentation
welrejdoall
 
Pigging Solutions Sustainability brochure.pdf
Pigging Solutions Sustainability brochure.pdfPigging Solutions Sustainability brochure.pdf
Pigging Solutions Sustainability brochure.pdf
Pigging Solutions
 
20240705 QFM024 Irresponsible AI Reading List June 2024
20240705 QFM024 Irresponsible AI Reading List June 202420240705 QFM024 Irresponsible AI Reading List June 2024
20240705 QFM024 Irresponsible AI Reading List June 2024
Matthew Sinclair
 
Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024
BookNet Canada
 
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Chris Swan
 
���文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
Toru Tamaki
 
20240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 202420240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 2024
Matthew Sinclair
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
rajancomputerfbd
 
UiPath Community Day Kraków: Devs4Devs Conference
UiPath Community Day Kraków: Devs4Devs ConferenceUiPath Community Day Kraków: Devs4Devs Conference
UiPath Community Day Kraków: Devs4Devs Conference
UiPathCommunity
 
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyyActive Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
RaminGhanbari2
 
20240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 202420240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 2024
Matthew Sinclair
 
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdfWhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
ArgaBisma
 
7 Most Powerful Solar Storms in the History of Earth.pdf
7 Most Powerful Solar Storms in the History of Earth.pdf7 Most Powerful Solar Storms in the History of Earth.pdf
7 Most Powerful Solar Storms in the History of Earth.pdf
Enterprise Wired
 
DealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 editionDealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 edition
Yevgen Sysoyev
 
Cookies program to display the information though cookie creation
Cookies program to display the information though cookie creationCookies program to display the information though cookie creation
Cookies program to display the information though cookie creation
shanthidl1
 

Recently uploaded (20)

Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...Transcript: Details of description part II: Describing images in practice - T...
Transcript: Details of description part II: Describing images in practice - T...
 
The Rise of Supernetwork Data Intensive Computing
The Rise of Supernetwork Data Intensive ComputingThe Rise of Supernetwork Data Intensive Computing
The Rise of Supernetwork Data Intensive Computing
 
The Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU CampusesThe Increasing Use of the National Research Platform by the CSU Campuses
The Increasing Use of the National Research Platform by the CSU Campuses
 
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
Understanding Insider Security Threats: Types, Examples, Effects, and Mitigat...
 
Recent Advancements in the NIST-JARVIS Infrastructure
Recent Advancements in the NIST-JARVIS InfrastructureRecent Advancements in the NIST-JARVIS Infrastructure
Recent Advancements in the NIST-JARVIS Infrastructure
 
Manual | Product | Research Presentation
Manual | Product | Research PresentationManual | Product | Research Presentation
Manual | Product | Research Presentation
 
Pigging Solutions Sustainability brochure.pdf
Pigging Solutions Sustainability brochure.pdfPigging Solutions Sustainability brochure.pdf
Pigging Solutions Sustainability brochure.pdf
 
20240705 QFM024 Irresponsible AI Reading List June 2024
20240705 QFM024 Irresponsible AI Reading List June 202420240705 QFM024 Irresponsible AI Reading List June 2024
20240705 QFM024 Irresponsible AI Reading List June 2024
 
Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024Details of description part II: Describing images in practice - Tech Forum 2024
Details of description part II: Describing images in practice - Tech Forum 2024
 
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
Fluttercon 2024: Showing that you care about security - OpenSSF Scorecards fo...
 
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
論文紹介:A Systematic Survey of Prompt Engineering on Vision-Language Foundation ...
 
20240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 202420240702 QFM021 Machine Intelligence Reading List June 2024
20240702 QFM021 Machine Intelligence Reading List June 2024
 
Choose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presenceChoose our Linux Web Hosting for a seamless and successful online presence
Choose our Linux Web Hosting for a seamless and successful online presence
 
UiPath Community Day Kraków: Devs4Devs Conference
UiPath Community Day Kraków: Devs4Devs ConferenceUiPath Community Day Kraków: Devs4Devs Conference
UiPath Community Day Kraków: Devs4Devs Conference
 
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyyActive Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
Active Inference is a veryyyyyyyyyyyyyyyyyyyyyyyy
 
20240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 202420240704 QFM023 Engineering Leadership Reading List June 2024
20240704 QFM023 Engineering Leadership Reading List June 2024
 
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdfWhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
WhatsApp Image 2024-03-27 at 08.19.52_bfd93109.pdf
 
7 Most Powerful Solar Storms in the History of Earth.pdf
7 Most Powerful Solar Storms in the History of Earth.pdf7 Most Powerful Solar Storms in the History of Earth.pdf
7 Most Powerful Solar Storms in the History of Earth.pdf
 
DealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 editionDealBook of Ukraine: 2024 edition
DealBook of Ukraine: 2024 edition
 
Cookies program to display the information though cookie creation
Cookies program to display the information though cookie creationCookies program to display the information though cookie creation
Cookies program to display the information though cookie creation
 

ForeScout IoT Enterprise Risk Report

  • 1. KNOW YOUR IoT SECURITY RISK How Hackable is Your Smart Enterprise? ForeScout IoT Enterprise Risk Report explores common IoT devices that make organizations vulnerable to dangerous – if not disastrous – attacks.
  • 2. IoT is here to stay, but the proliferation and ubiquity of these devices in the enterprise is creating a much larger attack surface and easy entry points for hackers to gain access to the network. The solution starts with real-time, continuous visibility and control of devices the instant they connect -- you cannot secure what you cannot see. Michael DeCesare, ForeScout President & CEO
  • 3. connected devices are in use today globally(a) 6.4 BILLION BY 2018, two thirds of enterprises will experience IoT security breaches (c) 20 BILLION The number of connected devices will reach more than by 2020 (a) 65% of enterprises have actively deployed IoT technologies as of June 2016 (b)
  • 4. RESEARCH OVERVIEW ForeScout IoT Enterprise Risk Report Industry attention has narrowed in on the threat of commonly known Internet of Things (IoT) devices and their potential safety implications to the home, but there is as much, if not more, to consider when exploring IoT threats in the enterprise. Research into seven common enterprise IoT devices revealed that their core technologies, fundamental development methods and rapid production makes implementing proper security within the software, firmware and hardware a complex, overlooked and often neglected task.
  • 5. The identified seven IoT devices can be hacked in as little as three minutes, but can take days or weeks to remediate. Should any of these devices become infected, hackers can plant backdoors to create and launch an automated IoT botnet DDoS attack. Cybercriminals can leverage jamming or spoofing techniques to hack smart enterprise security systems, enabling them to control motion sensors, locks and surveillance equipment. With VoIP phones, exploiting configuration settings to evade authentication can open opportunities for snooping and recording of calls. Via connected HVAC systems and energy meters, hackers can force critical rooms (for example, server rooms) to overheat critical infrastructure and ultimately cause physical damage. Key Findings
  • 6. DISASTROUS Could cause irreversible damage, invade user privacy, gain access to private corporate information or destroy critical equipment. DISRUPTIVE Can disrupt corporate and operational processes. DAMAGING Would allow snooping around a corporate network or extracting private credentials. IP-Connected Security Systems IP-Connected Infrastructure: Climate Control & Energy Meters Smart Video Conferencing Systems Connected Printers VoIP Phones Smart Fridges Smart Lightbulbs Danger Rankings
  • 7. When successfully hacked, all of these devices are a gateway into the broader enterprise network. Breaking it down even further, IoT hacks can lead to: Danger Scenarios Snooping on calls Accessing private company and user information Spying via video and microphone Disabling to allow physical break-ins Tampering with temperature controls and destroying critical equipment Obtaining user credentials Extracting Wi-Fi credentials to carry out further attacks
  • 8. EXPLORING SEVEN COMMON IoT DEVICES Where Do The Vulnerabilities Lie?
  • 9. Many use proprietary radio frequency technology that lacks authentication and encryption to communicate. They also have dependencies on some cloud services and are connected to the internet. Attackers can form radio signals to send false triggers and access system controls. Weak credentials can be used as ‘bouncing off’ points to attack other systems. Most use radio signals that are easy to detect and fail to employ frequency hopping techniques, leaving them open to jamming and spoofing. Jamming or spoofing an enterprise security system could allow criminals to turn off motion sensors, remotely open locks, or redirect/switch off surveillance equipment. IoT DEVICE RISKS IP-Connected Security Systems Use wireless communication to connect with other smart devices for easy entry and access, which can open the floodgates for crafty hackers. (See references page #1-3) DISASTROUS
  • 10. DISASTROUS IoT DEVICE RISKS IP-Connected Infrastructure: Climate Control & Energy Meters HVAC systems provide an avenue for hackers to gain network access. Enterprises are also using smart electric meters to monitor wireless energy – creating additional risk. HVAC systems are typically on the same network that internal systems are connected to, which hackers can easily access to intercept data, escalate privilege and carry out further attacks. Attackers can force critical rooms (for example, server rooms) to overheat and cause physical damage. Smart energy meters can allow attackers to alter the reported energy levels of a company - potentially leading to fraudulent accounting and metering. IP-connected infrastructure uses wireless technology that is often accessible to anyone within range. (See references page #4)
  • 11. (See references page #5-11) Vulnerable to exploits that allow remote attackers to control any of the apps on the system, take over social and communication apps, record audio and video. Since they are wired Ethernet or Wi-Fi connected, hackers have access to sensitive places like boardrooms, C-Level offices and conference rooms that are not often accessible by outside visitors. Attackers have full access to all software, memory and hardware, exposing the microphone, camera and stored credentials. Similar to all software, most use common OSs, which have significant overflow vulnerabilities. Buffer overflow allows the Smart TV to be accessible from behind a router or firewall, exposing it to intruders from anywhere on the Internet. Smart TVs connect to the local network over IP and also serve as a pivot point for hackers to gain full network access. Attackers can exploit other systems on the network entirely from a shell they’ve compromised on the TV. IoT DEVICE RISKS Smart Video Conference Systems Enable internet-based streaming, conference calling and screen-sharing, often only requiring the click of a button for users to share screens – and for hackers to commandeer it. DISRUPTIVE
  • 12. (See references page #12-21) IoT DEVICE RISKS Connected Printers Nearly all printers are networked over IP, making them accessible from virtually any computer on the network – and a welcome mat to hackers to infiltrate the enterprise. Without physical access, hackers can comprise printers to siphon private documents printed through them. This is almost undetectable without proper security and monitoring. By accessing specially crafted URLs that evade authentication, attackers can visit pages that expose the printer’s credentials. If printers are on a public network or attackers are on the same Wi-Fi network, they can send a specially crafted Simple Network Management Protocol (SNMP) packet to obtain the admin password, and gain full control of the printer. Many exploitable issues are are not resolvable without updates to firmware or an intrusion detection system. DISRUPTIVE
  • 13. Complex routing exposes phones to remote snooping and some can be activated as a speakerphone with no visible indication. Hackers can exploit configuration settings to evade authentication and then update the phone, allowing them to listen to phone conversations or make calls. Attackers only need to know the IP address of the phone to be able to access it. IoT DEVICE RISKS VoIP Phones VoIP phones leverage the network for many sophisticated features that makes communication easy, not only for employees – but also malicious hackers. (See references page #22-23) DISRUPTIVE
  • 14. (See references page #24) Due to lax certificate checking, attackers on the same network could conduct a MITM (man-in-the-middle) attack to intercept communication and modify traffic between a client and server. This can be done by injecting spoofed Address Resolution Protocol (ARP) requests or Domain Name System (DNS) responses, both of which are critical to IP networks today and provide no method of authentication or encryption. This grants attackers access to any of the integrated enterprise applications, and the user credentials associated with that account. IoT DEVICE RISKS Smart Fridges Wi-Fi-enabled refrigerators with LCD screens have access to widely used operational apps (such as scheduling applications, calendars and notification systems) and the credentials stored within. DAMAGING
  • 15. (See references page #25-27) Mesh network communication channels can be sniffed by attackers. By sniffing the network, attackers only need to be within Wi-Fi range of the smart bulb with no original access to the network. Hackers can extract password-protected Wi-Fi credentials without being on the network, allowing them to gain access to other systems and devices in the enterprise – from laptops to smartphones and even network-connected manufacturing systems. Some bulbs have been shown to send Wi-Fi credentials in plain text, making extraction possible. IoT DEVICE RISKS Smart Lightbulbs Smart lightbulbs operate on Wi-Fi and proprietary mesh networks – they can easily integrate into other connected systems that can be controlled by external devices and hackers. DAMAGING
  • 16. IoT threats could spread through networks and the internet. If a threat were to successfully infect a device and infiltrate one network, it could spread to an entirely separate, segregated network - just by being within wireless range of another IoT device, despite no previous communication between the two. IoT threats would work even more effectively by targeting the specialized wireless communication protocols that IoT devices share, such as Wi-Fi, Bluetooth, ZigBee. Anatomy of an IoT Attack
  • 18. Research Methodology Commissioned by ForeScout Technologies, the IoT Enterprise Risk Report employed the skills of Samy Kamkar, one of the world’s leading ethical hackers, to investigate the security risks posed by IoT devices in enterprise environments. The report sought to uncover vulnerabilities in enterprise-grade technology, utilizing both physical testing situations, as well as drawing from peer-reviewed industry research. Kamkar conducted extensive research (including reviewing datasheets, previous hacks, peer-reviewed/industry research, known CVEs and first-hand conversations with industry peers) to evaluate each device, looking into vulnerabilities of the following: inputs, outputs, physical ports, communication protocols, manufacturing techniques and software and/or firmware involved.
  • 19. While IoT devices make it possible for organizations to run faster and more efficiently, they are too often used with little regard to their security risk. The rush to deliver new types of IoT technologies sacrifices security – almost 100 percent of the time. Once these devices are on the network, it’s easy for malware to compromise them, or for a hacker to gain access through them and steal critical information. It’s a cybersecurity challenge and an opportunity to help CISOs fill the ensuing security gaps. Businesses need an agentless approach to be able to manage their IoT devices – helping them to see the devices in real time. Enterprise IoT devices, some of which were examined in this analysis, are not designed with security agents, and IT departments often turn a blind eye when new devices are added to the corporate network to avoid the hassle of re-deploying their security protections. In the age of IoT, visibility and control of devices on the network is a must have, not a nice to have. Summary
  • 20. Best Practices IoT security starts with full visibility and control over devices as soon as they connect to the corporate network. DISCOVER AND CLASSIFY IoT devices the instant they connect to the network CONTROL network access based on device type, posture and behavior ORCHESTRATE integrate islands of security; leverage existing investments for better protection
  • 21. About ForeScout ForeScout Technologies is transforming security through visibility. ForeScout offers Global 2000 enterprises and government organizations the unique ability to see devices, including non-traditional devices, the instant they connect to the network. Equally important, ForeScout lets you control these devices and orchestrate information sharing and operation among disparate security tools to accelerate incident response. Unlike traditional security alternatives, ForeScout achieves this without requiring software agents or previous device knowledge. The company's solutions integrate with leading network, security, mobility and IT management products to overcome security silos, automate workflows and enable significant cost savings. As of January 2016, more than 2,000 customers in over 60 countries improve their network security and compliance posture with ForeScout solutions. Learn more at ForeScout.com © 2016. ForeScout Technologies, Inc. is a privately held Delaware corporation. ForeScout, the ForeScout logo, ControlFabric, CounterACT Edge, ActiveResponse and CounterACT are trademarks or registered trademarks of ForeScout. Other names mentioned may be trademarks of their respective owners.
  • 22. Glossary IoT IP VoIP OS SNMP MITM ARP DNS OT IT DDoS Internet of Things Internet Protocol Voice Over Internet Protocol Operating System Simple Network Management Protocol Man-in-the-Middle Address Resolution Protocol Domain Name System Operational Technology Information Technology Distributed Denial of Service
  • 23. References a) Gartner Says 6.4 Billion Connected "Things" Will Be in Use in 2016, Up 30 Percent From 2015," Gartner. 10 November 2015. b) 451 Research: Today 65% of Enterprises Already Using Internet of Things; Business Value found in Optimizing Operations and Reducing Risk," 451 Research. 29 June 2016. c) Gens, F. "Webcast: IDC’s global technology predictions for 2016," IDC. 4 November 2015. 1) Rose, A. and Ramsey, B. “Picking Bluetooth Low Energy Locks from a Quarter Mile Away,” Merculite Security. 6 August 2016. 2) Jmaxxz, “Backdooring the Frontdoor.” 7 August 2015. 3) Fernandes, E., Jung, J. and Prakash, A, “Security Analysis of Emerging Smart Home Applications,” In Proceedings of 37th IEEE Symposium on Security and Privacy, May 2016. 4) “CVE-2016-4529,” CVE. 5 May 2016. 5) “Vulnerability Summary for CVE-2014-7911,” National Vulnerability Database. 15 December 2014. 6) “CVE-2014-6041,” CVE. 1 September 2014. 7) Lee, S and Kim, S. “Hacking, Surveilling, and Deceiving Victims on Smart TVs,” CIST. August 2013. 8) Grattafiori, A. “The Outer Limits: Hacking A Smart TV,” iSEC Partners. 28 October 2013. 9) “CVE-2012-5958,” CVE. 21 November 2012. 10) Russon, M. “It's official, your smart TV can be hijacked: Malware is holding viewers to ransom,” International Business Times. 12 January 2016. 11) Metzger, M. “Millions of smart TVs and remote control apps vulnerable,” SC Magazine. 9 December 2015. 12) “Samsung Printer SNMP Hardcoded Community String Authentication Bypass Vulnerability,” Acunetix. 25 March 2015. 13) “CVE-2015-1056,” CVE. 16 January 2015. 14) “CVE-2014-3111,” CVE. 29 April 2014. 15) “CVE-2013-4613,” CVE. 17 June 2013. 16) Costin, A. “Hacking printers: for fun and profit,” Hack.Lu. 2010. 17) “CVE-2013-2507,” CVE. 8 March 2013. 18) “CVE-2013-2670,” CVE. 22 March 2013. 19) “CVE-2013-2671,” CVE. 22 March 2013. 20) “CVE-2012-4964,” CVE. 17 September 2012. 21) “CVE-2012-4964,” CVE. 17 September 2012. 22) “Cisco Small Business SPA300 and SPA500 Series IP Phones Unauthenticated Remote Dial Vulnerability,” Cisco. 15 March 2015. 23) “Polycom Configuration,” Free Switch. 20 July 2014. 24) Venda, P. “Hacking DefCon 23’s IoT Village Samsung fridge,” Pen Test Partners. 18 August 2015. 25) Chapman, A. “Hacking into Internet Connected Light Bulbs,” Context. 4 July 2014. 26) “LIFX Firmware release 1 February 2015,” LIFX. 1 February 2015. 27) Wakefield, J., “Smart LED light bulbs leak Wi-Fi passwords”, BBC, 8 July 2014.