Quick! What are the chief security challenges involving IoT? Good chance your answer is something like “broad and diverse attack surface” or “potential for damage.” Good answers but one under evaluated area is the lack of humans as part of the solution. Explore some of the new challenges with IoT and potential mitigations associated with device lifespan, scale, ownership and trust. The presenter leveraged his broad experience in IoT security distilling the critical challenges and lessons learned for existing and next generation IoT implementations. This session helped attendees be more effective at evaluating IoT solutions from a security perspective. Points covered include:: • Lifespan: While most IT assets have five-years or less, how do we deal with devices that are deployed for a decade or more? How do we apply patches and policy to a diverse set of devices? Can devices apply new encryption algorithms or key lengths? • Scale: Any solution that involves “admin approval” fails at IoT scale. Even updates can create a self denial of service at the scale of a million devices. How can we safely apply automation and what parts of traditional security automate at scale? • Ownership: What happens when a hacker or competitor buys our devices? Who owns the data & apps when I sell my smart home or factory? • Trust: Without humans for passwords, resets or authorization approval, today's authentication paradigms need to change
