Case Studies on IoT Security

IoT security is the technology area concerned with safeguarding connected devices and networks in the internet of things (IoT).

01

Organization:   Confidential | Fortune 50
Industry:   Global Financial Services Firm
Size:   55+ Global DCs | 50,000+ employees
Environment:   Legacy, Mainframe, Hybrid Public and Private Cloud
Summary:

Sr. Management was growing concerned with the increasing use of IoT within their data centers and wanted an assessment of the security posture of these types of devices, potential impacts, and recommendations.

  • Zero current observation of admin access, baselines, and architecture.
  • Low maturity in modern IoT administrative controls (i.e., policies, standards, procedures, etc.).
Actions:
Within 2 months, we interviewed Technology department key stakeholders (i.e., enterprise architecture, DC managers, IT, and security engineers, etc.). Discovered a 200% increase in IoT usage then originally stated by Sr. Management. Review and update current security architecture diagrams for IoT. Provided posture (control) assessment, risk and impact analysis, and recommendations. Based on our effort’s organization impact was:
  • 300% improvement in IoT security requirements and environments security posture via CSA CCM for IoT
  • Reported 15+ cyber risk findings to the risk management process:
  • IoT purchasing was not meeting 3rd -Party review requirements or review reviews.
  • Lack of unique identities, registration, and update plan for IoT devices.​
  • Use of unsecured protocols and lack of segmentation into IT management and Prod environments.
  • Sr. Mgmt. ensured risk owners were notified and mitigation action was completed.

02

Organization:   Confidential – Chicago Fortune 2,000 Company
Industry:   U.S. Wide Mechanical Parts Manufacturing
Size:   7,000+ employees
Environment:   SCADA, Mainframe, legacy, VMware, and SaaS Public Cloud (e.g., ServiceNow, etc.)
Summary:

The client was considering the use of various IoT devices for manufacturing facilities and technology improvements. Their CTO was security conscious and had concerns with the use of this genre of technology. He wanted us to consult on purchasing, implementation, security management best practices of IoT.

  • The client had no CISO or formal information security department. Only three security personnel.
  • The company had little admin control capability and an overall low maturity level.
Actions:
We review the current security posture and capabilities. Combined a mix of IoT and security purchasing and implementation best practices to build a plan to use IoT safely within the organization at a level of risk that was within the Sr. Management’s threshold within 6 weeks.
  • Designed new IoT security architecture and implementation plans that turned IoT into a service via Google Cloud Platform ingestion (API connections).
  • Implemented unique ID via PKI, GCP secure storage, and implemented registration of IoT.
  • Built GCP accessible dashboard and ingest logs securely into SIEMs and IT OPS on-prem.
  • 50% upgrade in overall security posture. Proposed new processes (security engineering, access monitoring, risk management, and change review process, etc.).
  • Created checklist for IoT purchasing requirements and 3rd -Party vetting.
  • We ensured the registration of all types of IoT devices.
  • We implemented secure keys (challenge/response), segmentation, and key mgmt. policies.

03

Organization:   Confidential – Public Healthcare Organization
Industry:   Dallas Based Hospital
Size:   1,500+ employees
Environment:   Legacy, SaaS (e.g., ServiceNow, MS 365, Slack, etc.) and Hybrid Public Cloud (Azure)
Summary:

The client used an extraordinary amount of medical IoT devices within its medical departments in addition to standard building and IT operational IoT device usage. The CIO had recently seen a TED Talk about medical device security issues.

  • The organization had little security support. Sec Manager had under 8 personnel and was overwhelmed.
  • The hospital’s security section was only two years old and full security posture was still unclear.
Actions:
Throughout 7 months, we led several engagements to develop many improvements via an IoT security strategy, designed purchasing methodology, and implemented third-party services and solutions to help improve both IoT and technology security.
  • 100% completion of IoT inventory and help develop a tracking system solution that included IoT devices.
  • 150% improvement in IoT security posture. Designed solutions to help monitor IoT and processes to keep secure (e.g., third-party review, security architecture reviews, baseline hardening process, risk management, change management.) via CSA CCM best practices:
  • We prioritized high assurance vendors with secure chip technology and secure protocols.
  • Built GCP accessible dashboard and ingest logs securely into SIEMs and IT OPS on-prem.
SOCIAL MEDIA
  • LinkedIn
  • Twitter
Copyrights  2020 by CyberSEC Geek, Inc. All Rights reserved