All posts by F Khan

About F Khan

Tech-junkie, with a special affection for security issues as they relate to telecom and enterprise, mobile, standards, social media, and gadgets.

Our Future Security Practitioners 

Yesterday, I had opportunity to speak to the Electronic Technologist class at a local college on cyber security. It was great to see all the cool things they were building but also have an open discussion on how they can help to build the next generation of secure IoT products and solutions. It was also refreshing to hear how many of them recognize their privacy and were concerned about the amount of data collected on them. Recently, I was told that youth don’t care about their identities and protecting it — it is all about getting free access. I was really disturbed by this especially when I am teaching my kids to more vigilant about the services they use and information they share.

I spent 2+ hours with students from CEGEP and I have to say I don’t know who was more excited about the conversation them or me. It is always great talking to next generation of tech workers but with electronics a big part of my childhood I love being around breadboards, signal and power generators and multimeters.

Thank-you Marc for making this happen. I had a great time with the students yesterday. Also a big shout out to Madame Bijou who helped me on the presentation graphics. Not bad for a 10 year old!

Facebooktwittergoogle_plusredditpinterestlinkedin

What Makes Industrial Control Systems a Target for Attack?

There is a great article from Trend Micro on why attackers target Industrial Control Systems (ICS) and how the Industrial Internet of Things (IIoT) will affect it. This is worth knowing as ICS is used to describe dissimilar types of control systems and associated instrumentation, which include the devices, systems, networks, and controls used to operate and/or automate industrial processes.  ICS are used in almost every industrial sector and critical infrastructure from manufacturing, transportation, energy, and water treatment to running the power grid, regulating energy use in a building or managing the process of brewing beer.

At a presentation I gave at Cyber Security 2017: Securing the Smart City of the Future I spoke about the anatomy of an attack but didn’t get into the details as to the motivation or technicalities. ICS have been with us for more than a few years but recent modernization has created new ways for these systems to communicate with their controller. This has improved overall productivity but not security. New security issues have arisen that can be exploited by cybercriminals including:

  • Components that were not meant to be for public access are now accessible via the Internet.
  • Security and privacy features that were not considered by solution architects and engineers at design time.
  • Threat modelling not conducted either by the component manufacture or the solution provider.
  • Products that are not required to be fully tested or assessed to provide a minimum level of assurance or security.
  • Installations that were not formally evaluated for cyber risk prior to deployment.
  • An implicit trust at the systems operational level that all components are safe.

Increased aggressive targeting of these will impact many areas including smart cities, smart manufacturing, smart infrastructure projects and even our soon to be smart homes and cars unless we can get control of these issues. In many cases of these attacks data risk is the least of our worries as they could potentially result in injury or death. To deal with this comprehensively everyone in the product and service chain must play their part:

  1. Manufacturers need to ensure that their products are designed with security, privacy and safety in mind. This includes a multitude of aspects depending on the product being developed. Only through comprehensive threat modelling at design time will they fully understand how attacks can happen in the field and the necessary controls that will be required.
  1. Implementers need to conduct security testing and evaluation at all stages of the project to ensure that systems are not misconfigured or prone to attack once in the field.
  1. Customers whether they are a city manager, a building manager or an information security manager need to better understand the risks to their specific deployments including how to perform Threat & Risk Assessment (TRAs) and Privacy Impact Assessments (PIAs).

Always remember that security is more than a technology you can just implement. Attempting to protect bad coding and engineering practices with a badly configured firewall will just end up in an attack succeeding.

Lastly, the authors of the article reference the NIST Security Guide for ICS, I would recommend that you also look at IEC 62443. Why? It was written so that an ICS company (vendor, implementer or purchaser) could be evaluated and tested against stringent controls for risk. This wide series of standards covers the breath of deployment and in-field issues that need to be considered and assessed against. It forces all parties involved to get their act together and ensure they have important aspects such as integrating activities across the Software Development Life Cycle (to help discover and reduce vulnerabilities early and build security in) and operational security policies and procedures. You might be surprised how many don’t.

Facebooktwittergoogle_plusredditpinterestlinkedin

The Smart City Under Attack – CBoC Presentation

I recently got an opportunity to speak at the Conference Board of Canada’s Securing the Smart City of the Future. It was great to be able to speak to those dealing with the daunting challenge of managing the issues related to security, privacy and safety risks while still providing smart city services.

It is clear that the potential benefits of fully-connected smart cities fed by sensors and data are significant especially when seen in the advance of the Internet of Things (IoT). These benefits could tackle some of the greatest problems with urbanization such as traffic congestion, inefficient use of energy, and pollution. As great as these potential benefits are so are the risks and unanswered questions that the integration of new technology brings. Countries looking to implement smart city initiatives need to have a national policy that mandates aspects of security, privacy and safety. This policy should include the following as a minimum:

  • Requirements for an Information Security Management System (ISMS).
  • City breach plans for emergency services, vendors, citizens, etc.
  • Security tested components and solutions that are validated prior to release.
  • “Assurance” from solution providers and vendors for their products/services.
  • Buyers requesting that products and solutions be evaluated.
  • Demand Threat & Risk Assessment (TRAs) and Privacy Impact Assessments (PIAs) for all solutions prior to deployment by City Managers.
  • Respect for the privacy of citizens.

The security breaches in the recent past and the ongoing increase in cyber attacks and crime have made one thing very clear: In building the smart cities of tomorrow we need to be smart! Bearing this in mind, what is the biggest barrier to smart city entry?

The biggest barrier seems to be security and privacy of the sensors and data – the very things that make a city smart. The concern seems to be around data breach and how to minimize the exposure of the sensors in-field. However, in the past year or so there seems to have been a shift in the mind set of what is more important: a $5 sensor or the data we collect on people and objects. Clearly the data protection is more important. An example would be smart city projects in Canada that want to provide more real-time information to citizens about services and conditions. It requires them to track citizens to offer this service which means that there are substantial privacy concerns. The client can share lots of data but if it becomes compromised the city collecting it is liable under new legislation in Canada. Cities are taking the time to understand the risks and prepare for the eventuality of data breach and invasion of privacy.

You can see presentation that I gave below. As always if you have any questions about the presentation, please do not hesitate to contact us for clarification.

 

CB0C A Smart City Under Attack – TwelveDot

Facebooktwittergoogle_plusredditpinterestlinkedin

Mac OS Is A Target

If you own an Apple product and  have not seen or heard about the recent increase of nasty malware targeting Mac OS then now is your chance to get up to speed. I know that many of you out there using this Mac OS do so due to ease of use and seamless integration into your tech toys like iPhones and iPads.  The belief that Windows users were the only ones with a malware problem is a myth. You need to wake up to fact that your laptop, iPhone or iPad is being targeted; the malware is getting really sophisticated and all platforms are susceptible to attack!

Here are some examples of the recent malware you should know about:

Proton – The malware includes root-access privileges and features that allow an attacker to obtain full control of the victim’s computer. Its capabilities include: running real-time console commands and file-manager, key logging, SSH/VNC connectivity, screenshots, webcam operation and the ability to present a custom native window requesting information such as a credit-card, driver’s license and more. The malware also boasts the capability of iCloud access, even when two-factor authentication is enabled.

Xagent – This malware contains payload that can make a compromised system running Mac OS X provide passwords, take screen captures and wipe iPhone backups stored on the Mac OS system.

As you can see being a Mac user  does not guarantee security and this scenario is only going to get worse. For your own sake please always keep that in mind. That said, here is what you can do to protect yourself:

  1. Use Time Machine to make backs up regularly and ensure they are encrypted. I prefer not to use iCloud due to the fact I am not really sure who Apple shares this data with. While they say things publicly the other side of the fence might offer a differing view.
  2. Ensure all iPhone backups are also encrypted.
  3. Use a tool such as Little Snitch to determine when unknown connections are leaving your Mac. Getting to know what your computer is doing and what it should be doing is key to early detection of compromise.
  4. Determine if a downloaded application might not be what you think it is using Suspicious Package.
  5. Get alerted if your being watched with OverSight.
  6. For your base install you already have the following:
    1. Using a passphrase for a password that 20+ characters long
    2. Using FileVault
    3. Using DuckDuckGo for your searching and research
    4. Use a VPN if you have to use a public or untrusted WiFi provider
    5. Track the security news for new developments in Mac OS malware

The main goal here is to not be an easy target and to create as many layers of defense as possible to protect yourself. As in life, prevention is always better than the cure!

Facebooktwittergoogle_plusredditpinterestlinkedin

Maker Faire Ottawa

 

img_4118

This past weekend we participated in Maker Faire Ottawa which is an all-ages gathering of tech enthusiasts, crafters, educators, tinkerers, hobbyists, engineers, science clubs, authors, artists, students, and commercial exhibitors. The location for this second Faire was the Aberdeen Pavilion in Ottawa’s historic fairgrounds and this year we got a booth to demo Hive Sense.  As you may know we are helping Algonquin College with bee research and wanted to provide the community with an update on the project. img_4122

It was great to see so many people with knowledge of the problem and we enjoyed the dialogue we were able to have with so many local professional and amateur bee keepers. We are currently working on building out a new service infrastructure and web site for our project and hope to have four to five hives monitored prior to the snow flying. Once these hives are monitored we will announce it on all our channels so you can track the progress and see the data.

Maker Faire is, according to the organizers, the Greatest Show (and Tell) on earth so it was not surprising to have had lots of cool projects again this year. While there were many 3D printing demos and projects it was nice to see groups and clubs engaging kids in robotics and coding as this is a great way to start playing with open source technology at an early age. There were programs even for big kids so there was no need to feel left out or to worry lol.

We had many attendees drop by our booth to learn about the concept of our project. Many were not technologists, engineers, or even web savvy individuals but they dropped in to see what the project was all about. It was also nice to hear from all the people who remembered their grandfather’s hives or when they lived on a farm. We keep forgetting that about 40 years ago a big part of our economy was agriculture driven especially in the Ottawa Valley.

We are looking forward to the 2017 event and being able to show what we have learned and how to get involved with the project in the future so… stay tuned.

If you have any questions in the mean time please do not hesitate to reach out to us for this or other IoT projects.

img_4112

Facebooktwittergoogle_plusredditpinterestlinkedin

RIoT Control – A Book Review

riot-control

Coming soon to a bookstore (or Kindle) near you is… a first of a kind book on how to approach security for the Internet of Things (IoT). This book is an assessment of how to control and manage Risk and the Internet of Things – RIoT Control. It is targeted at executives, engineers and architects either responsible for considering or implementing IoT solutions within their organizations. It is also a useful read for entrepreneurs, risk managers, security practitioners, businesses line managers and anyone not interested in the operational details of IoT security but wanting to understand the problem.

I was fortunate and honoured that Tyson Macaulay, the author, asked me to be a reviewer of this book. In the process I was able to learn even more about this increasingly important topic for cyber security practitioners. Tyson and I have been working together for several years on IoT security under ISO and have represented Canada internationally for over five years to create the baseline considerations (or controls) that should be considered for IoT implementations. Over this time I have realized how broad a topic IoT is, how challenging its issues are and how complex some of the solutions are for some sectors.

Implementing cyber security controls in some of sectors is not going to be easy to say the least. Companies are going to have to shift their mindset to building an adaptive and strong “culture” of cyber security in order to be able to succeed in IoT. One of the key barriers to adoption right now is security and privacy considerations. Product and service providers are going to have to prove to customers that their products are both designed and tested to a specific security level. The daily news of products or solutions that have been compromised is proof positive of the need to secure these solutions comprehensively. Even the NSA and FBI are hiring highly skilled hackers to be able to compromise networks and data of users of IoT solutions.

RIoT Control walks the reader through the process of IoT cyber security considerations and gives many useful examples to help the reader better understand the concepts. It provides the necessary background and details that designers and implementers need to consider for new IoT products and solutions. And yes, security and privacy need to be considered at the design and concept stage.

The list of the chapters contained in the book are:

Chapter 1 – Introduction to IoT

Chapter 2 – Anatomy of IoT

Chapter 3 – Requirements and Risk Management

Chapter 4 – Business and Organizational Requirements

Chapter 5 – Operational and Process Requirements Framework

Chapter 6 – Safety Requirements in the IoT

Chapter 7 – Confidentiality and Integrity

Chapter 8 – Availability and Reliability Requirements

Chapter 9 – Identity and Access Control Requirements

Chapter 10 – Usage Context and Environmental Requirements

Chapter 11-  Interoperability, Flexibility and Industrial Design Requirements

Chapter 12 – Threats and Impacts to the IoT

Chapter 13 – RIoT Control

I hope you enjoy reading this book as much as I did. In this book Tyson has done a great job of explaining the business and security concepts of IoT to executives, architects, engineers and anyone else responsible for IoT in a comprehensive way. In doing so he provides the necessary background for building a cyber security IoT practice and ensures that customers are provided a higher level of assurance to products and services they are selecting for IoT.

If  you want to buy this  book, for your convenience, here is the link to RIoT Control on Amazon.

 

Facebooktwittergoogle_plusredditpinterestlinkedin

Maker Faire Kathmandu

img_3973

I just returned from Kathmandu after a great weekend presenting our Hive Sense project. If you don’t know about Hive Sense it is a project we started under Random Hacks of Kindness (RHoK) Ottawa to help Algonquin College monitor some bee hives. The goal is better understand bee behaviour and find out why bees are dying while teaching students about where food comes from and our impact on our food chain. We are in the process of helping get relocated hives under monitoring and will provide a link to this data in the coming months.

Our hope is to help better educate people on the importance to bees and the fact that without them we would not have any fruits or vegetables. Bees are responsible for one out of every three bites of food we consume and are an agricultural commodity that’s been valued at $15 billion annually in the U.S. alone. They are a major unpaid workforce with a huge work ethic — bees from one hive can collect pollen from up to 100,000 flowering plants in a single day and pollinate many of them while doing so. They are a critical part of our food chain and they are dying but most people appear to be not alarmed by this — but they should be! If the bees are dying from pesticide exposure or other environmental factors what impact is it having on us and our children? Cancer, DNA mutations, who knows? We need to collect the data to better understand the problem.

img_3995

These are important questions that need to get answered but I am not a research scientist. I am technologist that can build solutions and so we are doing our part to help in both bee and agriculture research. Oh, did I mention this is an IoT solution.

As for the Maker Faire Kathmandu, it was great to see so many people out. While it rained buckets the first day and our booth got flooded – funny now but the thought of having my Mac book destroyed from a power surge was a bit overwhelming at the time. That said the interest in bees and bee life was awesome. It was also great to have my placard (see above photo) signed by so many people.

I hope to return some day to Nepal. The people are very friendly and love talking to you. I love all the temples around the city and was able to get a bird’s eye view of Mount Everest in all its towering majesty. (see below)

img_4026

Facebooktwittergoogle_plusredditpinterestlinkedin

For the Bees

IMG_3609This past weekend we (TwelveDot Labs that is) participated in our first Ottawa Random Hacks of Kindness (RHOK) after being a sponsor for the past three years.

Algonquin’s School of Hospitality and Tourism is on a mission to better help students to understand the “food to fork” concept and the impact the changing environment is having on the human food chain. And we were happy to partner with Algonquin College on a bee hive monitoring project .

We had to do a lot over the weekend and not a lot of time to do it in (about 14 hours) but we managed to get sensors logging into our database. All of this was done with a team of only eight! Without the hard work and efforts of Kirin, Kaelan, Bernard, Ying, Cid, Jared and Alf,  this project would not have come together in such a short period. We were, and remain, truly grateful to all of them for giving up their weekend for this project. We also had significant assistance from Dave of Algonquin College who is both a chef and understudy beekeeper. He  provided very useful details on how bees live and our impact on them in general and every time we open a hive.

That said, we know that there are many other hackathons that have similar projects and even commercial monitoring solutions for monitoring bee hives right now.  We also know that there are no solutions which are purpose-built for research and non-intrusive to the bee environment. The goal of our project was to develop a solution that included these two aspects in the overall design. Over the course of the weekend we:

  1. Used an Arduino (an open-source prototyping platform based on easy-to-use hardware and software) based platform to connect our sensors.
  2. Designed a base mobile User Experience (UX).
  3. Setup and configured a time-series database.
  4. Fine tuned our sensors for data collection via the code.
  5. Created a web site to document our project.
  6. Developed a design to incorporate sensors non-intrusively to a bee hive – we actually did this in the last hour of the event!bee-plate

Our goal going forward will be to continue this work with Algonquin as bees are important to our food chain. We are doing this for bees as much as we are doing it for ourselves.

In the coming months we will be proving all the initial design and data collected for bee research and hope to have our own data available as well. If you want to know more  about our work and progress, we invite you to go to our project website.

Lastly, do not hesitate to contact us to find out if we can help your field research project.

 

Facebooktwittergoogle_plusredditpinterestlinkedin

Ottawa IoT Meetup – June 28th

This month I have the honour of being the presenter at the YOW IoT Meetup and I hope to see you there. Please bring all your questions. I look forward to providing guidance and suggestions to your projects. Here is the outline for my discussion:

Security and Privacy for IoT: A Standards Based Approach

IoT has the promise to change our lives and provide interactions that were previously unheard of – with upwards of 20 billion devices connected. However, one of biggest barriers to adoption is security and privacy.

Daily reports of compromised networks and systems have become common place and many IoT services and solutions will be based on this same architectures and techniques – risky! The only way to change the IoT security landscape is to change our approach to design.

Our discussion will explore how to make security and privacy part of your daily ritual with the aim to significantly reduce the cyber exposure of your products and solutions. As we are quite active in the development of both IoT and security standards, we use a standards based approach to solving these problems.

International standards provide a global yardstick from which to base build and design solutions. In the age of IoT, even small companies are being forced to think globally.

We will look at:

  • ISO standardization of IoT
  • Security considerations for your organization
  • Security considerations at design and development
  • Testing and evaluation of IoT solutions
  • Privacy considerations and practices

We will record all the questions we get and post them for all to see. I am sure that you will agree with me  that it is important to share as I believe the same root issues and problems are being experienced by many product and solutions organizations.

Facebooktwittergoogle_plusredditpinterestlinkedin

Here’s why the hack we are participating in RHOK!

For several years now we have been supporting Random Hacks of Kindness (RHOK) as a sponsor. We did this because RHOK is a hackathon for social good: it brings together volunteer developers and tech-savvy do-gooders to work with charities, community groups and social enterprises. And for us it has been hacking good as it is the type of event that really highlights the role private companies can and need to play in their local communities.

This year, however, we decided to hack our support into participation and put in a team to help the cause hands-on. Our decision was motivated by a request from the RHOK organizers to be more active in the cause and I agreed to do so long as our project was Internet of Things (IoT) based. It was also time that we ate some of our own “dog food”. FYI: the term “eating your own dog food,” in the software industry, means using the code you’re developing for your own daily needs: basically, being a user as well as a developer or, in our case, a sponsor and a participant.

I met with my team so that we could begin prepping for our IoT project. I asked Brett Tackaberry, a good friend of mine who is very active in the Ottawa community, to go out and find a project. And found one he did and not just any project but one that has sensors, research and will run for a long time – at least we believe so. So far we have ordered the sensors, come up with a high level architecture and designed a User Experience (UX) for the Version 1. We are cheating a little here but had no choice as one weekend is not enough to prepare and build the prototype of our IoT solution!

You may be asking “What is this solution?” Well you will have to follow us on Twitter for updates to see what we are building. If you happen to be in the Ottawa area on the weekend of June 24th, I invite you to drop in to RHOK to see us and possibly help us or others out on our projects. You will also have the chance to see how matching up organisations that have a social impact with skilled technologists, who want to make a difference, can lead to developing open-source solutions to the challenges facing society today and tomorrow.

As a small R&D group, TwelveDot Labs is primarily focused on R&D in mobile, cloud and IoT. We are hired to evaluate  security for IoT technologies and on building cool technology solutions that incorporate both security and privacy. We intend to do for RHOK what we do for our clients: deliver a solution that works, is secure and private, and is, above all cost effective.

Facebooktwittergoogle_plusredditpinterestlinkedin