mobile-logo
 

Cyber Security

Apr
09
2020
Audit and Assessment Cyber Security IoT ISO Secure By Design

To everyone that attending the IoT Ottawa Virtual Meetup thank-you for taking the time to attend this session and for participating. It was a good discussion and I hope it was helpful for those of you that attended. It is good to see that events like these can still be held despite the current conditions.

For those of you that were not able to make it to the Meetup here is the abstract of the presentation:

One of the biggest barriers for the adoption of the IoT products is the potential security and privacy risks. To help overcome this reluctance vendors need to ensure that they are clearly demonstrating to the market they have implemented security and privacy in their solution. This workshop will provide an understanding how to secure an IoT solution leveraging a risk based approach using standards. We are going to present how IoT projects should be approached to ensure both security and privacy requirements are included at design time and be validated during the development lifecycle. This is based on countless projects where we have worked on evaluating IoT products in multiple sectors to identify design and process issues including formal testing to T200 and UL2900.

We will share the best practices for the following:

  1. Design considerations
  2. Setting up a governance function
  3. How to operate a Secure Development Lifecycle (SDLC)
  4. Operational Considerations
  5. Testing and Verification

Other topics of discussion include:

  1. Latest developments in the global market for security and privacy requirements
  2. Strategy considerations

This session will be provided as a workshop to help SME’s hopefully address their security and privacy issues. Please bring your questions and concerns.

As mentioned, I am providing the presentation, the IoT attack surface poster and worksheet for the presentation. I am also hoping to provide the video of the session available at a later date as well.

Note: I will be posting the worksheet a bit later but wanted to share the presentation and poster right away.

Please reach out for any clarifications or questions you may have and most of all be safe everyone!

IoT Threat Poster

IoT Ottawa – Blueprint for IoT Security

 

0
Dec
20
2019
Cyber Security Secure By Design Secure Coding Security

It is hard to believe that we are days away from the 10 year anniversary of our humble beginnings. We have come so far from the company that I started in my basement. Back then it was just a dream of starting something small as an independent consultant but wanting to share my expertise in cyber to help clients. Now we have grown to a team of 7 and have offices in a great part of town in Ottawa, Canada and global clients. We are bursting at the seams and have already expanded our office footprint. With next year poised for more growth we will be expanding again and adding more R&D capacity in the process.

I have learned lots during my tenure as both a business owner and executive, and have made some good and bad decisions along the way. I never shy away from admitting my mistakes especially some questionable partners and sub-contractors – but life and business are about learning and I am grateful for the lessons.  I am humbled and blessed by our staff, clients, and partners we currently have as without you none of this would exist.

We will be refining our services as we shift the company from consulting to formal testing and evaluation and secure product development.Our capabilities will be expanding in the next year including our Hut6 platform to offer more services. With our growth in education, healthcare, and industrial our next 10 years looks very promising and with our current team in place we are definitely going to make this happen.

For all of you who believed in me and my dream thank-you! Lets make the next 10 years better than the first as we enter the teenager years of the company.

//Faud

0
Dec
01
2019
Cyber Security IoT ISO Standards

The last few months have been hectic as many of the standards groups are pushing to get security and privacy aspects of IoT under control. As we get ready to whine down the year lets look at where we are:

a. ISO/IEC 27030 IoT Security and Privacy – This standard has now moved to Committee Draft (CD) and as the editor I am really proud of my editing team and global experts to get us her rather quickly. I believe this international standard will set the bar for IoT products globally and is highly anticipated by many groups and organizations globally.

b. ISO/IEC 27042 IoT Basline – This standard is currently a New Work Item Proposal (NWIP) and will be going to voting in the next few months. This is the result of a Adhoc Group that studied this and determined that we need a baseline for vendors who are entering the IoT product field. The goal is that this would be just a starting point and not the finish line for securing the product and organization but would provide regulators the guidance they need for products.

c. IoT Platform is group that has developed as result of work completed by the Internet Society in Canada. As a result of this work, a platform of regulators has formed and continues to expand how to ensure that IoT products are secure both now and in the future. As a result of this many nations will be making formal announcements to aspects that products should have. In Canada this has posted by Office of Consumer Affairs (OCA) and details are located here. I believe that this is good starting point but an hope that vendors will realized these aspects alone do not make a secure product that only happens when security and privacy become an embedded part of the organization and is driven into the development processes. I also hope that our regulators hold vendors to a higher sense of responsibility for security and products going forward.

d. CSA T200 has been released as an Express Standard and over the next 24 months we hope to develop the final version that will be used as the baseline for products and organizations in Canada and the US for meeting or exceeding regulatory requirements for IoT products. In the future we are looking for the implementation of a cyber label on products for security. More to come on this in the future.

e. IEC 30149 IoT Trustworthiness is still very much a work in progress as many experts are still trying to determine what consitutes trust. While one faction believes it is result of SDLC, I am very much of the opinion that this is not the case but view of the organization that includes the development processes. The approach must be based on an approach such as ISO 42010 that will allow any organization to determine the specific attributes to trust for their company and products being developed.

Here is the content for the IoT Checklist:

1. Ask how the device is collecting, using, and sharing your data

  • Is the device collecting my data? How is the device collecting my data?
  • Is the device using my data? How is the device using my data?
  • Is the device sharing my data? How is the device sharing my data?
  • With whom is the device sharing my data?
  • Is the device collecting data I do not want shared, such as my location?
  • Is there an option for me to opt out of the device collecting, sharing or using my data?
  • Will I be able to opt out of additional or future features that collect data, without opting out of security updates?

2. Ask about the device’s lifecycle, if it can function offline, and if there is product support available

  • How long can I expect the device to work?
  • How long are security patches and upgrades expected to be available for this product?
  • What kind of support is available should I experience problems with the device or suspect the device has been compromised?
  • Will the device work without an Internet connection? Can I use the product if the Internet is down? What features work offline?
  • Will the device work if the manufacturer ceases to exist?

3. Ask if the device you are buying is from a reputable manufacturer

  • Does the company have a good track record when it comes to protecting its customers’ privacy and security?
  • Check for media coverage online about whether or not this company has experienced a security breach in the past. If so, what was the impact on its consumers? What measures did the company take to prevent future security breaches?
  • Are there independent user reviews of the product I can consult?

For more tips on how to approach a business or manufacturer about your privacy and security concerns, check out this tip sheet.

Lots of progress this past year and lots more to come. I do see a shift that regulators globally are moving towards requirements for IoT companies. I hope it is a wake up call for vendors that due to the lack of security controls and the growing attack surface that IoT vendors will see a day where their products will undergo formal testing and evaluation to enter certain markets globally.

 

0
Jun
28
2019
Audit and Assessment Cyber Security Healthcare

Today, TwelveDot is starting a multiyear R&D project with Carleton University in Ottawa, Canada and several other medical partners. The goal of this research to create a risk framework for evaluating the usage of IoT technologies in hospitals, clinics and other out patient services. As the technology/cyber partner for this research project, we are excited to be bringing our expertise in IoT and assessment to this project, and are look forward to working with all healthcare providers to make these environments much safer from a cyber perspective.

Lets help the healthcare professionals focus on getting our sick citizens well again and reduce the attack surface of the products and services they use.

 

0
May
09
2019
Cyber Security IoT Secure By Design

Today our CEO presented at IoT613 an Ottawa based conference focused on all things IoT. There was also a developer day before the conference as well. The conference had really good attendance including several vendors or other organizations working in this area. If you are interested in this topic plan to attend the conference next year, speakers provide a range of views and experiences.

Our presentation focused on how to evaluate IoT products and solutions for both security and privacy. The lack of education in this area is of concern as many product companies are amping up their marketing to “assure” of product safety but yet many products have never undergone formal testing and certification nor do many even have secure by design or privacy by design approaches. Security for most IoT vendors is an after thought. When purchasing one of these products assume that security and privacy testing has not been conducted.

If you did not make it out to the presentation please find it attached, we hope that it helps to be better understand the issues.

IoT613 – TwelveDot – May 9 2019

0
Jan
02
2019
Cyber Security IoT Secure By Design Security

Our CEO and President will be on a International Panel to discuss labeling for cyber for consumer and business products in the Canadian marketplace. As the Chair for the ISOC Labeling group for the IoT Security and Privacy Multistakeholder Process, Faud will be discussing what consumers and businesses need to consider when purchasing products and services and the current development of related standards and projects in Canada.

Please reach out on Twitter or LinkedIn to connect at the show. Hope to see you there.

Link to CES Session

 

 

0
Apr
06
2018
Cyber Security Infrastructure IoT IPv6 ISO Secure By Design Secure Coding Uncategorised

This past week I was fortunate to be invited as a guest speaker for the 1st Internet Society meeting on IoT security. This meeting was well attended from government, private sector companies and academia. It was a means to get on the same page to issues at hand and how do we as users, developers and government secure the Internet and IoT.

The key issues at hand include:

1. Awareness to the issue of IoT Security for Canadian, not just individuals but organizations who want to deploy IoT technologies

2. What exists now from standards and best practice perspective and what approaches can be used

3. What can be done to ensure the next generation of these devices is not a source of another DDoS or other malware on the Internet.

As promised, I am including my presentation and mind map that was presented. Please feel free to share this as necessary, the more groups and individuals who are talking about this subject the better.

For more information check out ISOC here.

ISOC Ottawa_v1

IoT Attack Surface_MindMap

 

0
Jan
02
2018
Cyber Security General News

As we start another new year in business, I wanted to take this opportunity to thank all our customers, partners, and staff for the outstanding work we have accomplished to date. Over the past 8 years we have accomplished quite a bit with a small team and as we move into our ninth year we are expecting significant growth and expansion throughout the year.

Here is some of the small list of our accomplishments:

  1. Developed a proprietary method for evaluation mobile applications (2011)
  2. Developed a proprietary method for evaluating IoT solutions (mobile, cloud, and devices) (2014)
  3. Developed a platform for secure file transfers for clients and partners (2015)

This year, we look forward to launching an ISMS assessment app and platform to help us create more secure businesses using a tired and proven framework for cyber security. This will aid in our continued expansion into all corners of the globe with support by our partners.

Recently we have jointed SDChain as a advisor. SDChain envisions that IoT data from the physical world, should be sharable via a fast and cost-effective digital blockchain network where data producers and data users conduct digital asset exchange, within an open partnership ecosystem, based on globally standardized IoT six-domain model.

We look forward to sharing and securing the world one company and app at time. Join us for the journey.

 

0
Feb
03
2017
Cyber Security IoT Security Sensors Smart City

I was asked to present at the Cyber Security 2017: Securing the Smart City of the Future conference which is taking place on February 27 – 28th in Ottawa. This is a Conference Board of Canada event and will be providing insights from the experts on smart cities, and the impact that they will have on urban life and business in the future. My presentation on Monday, February 27th (Plenary 3)  is called “Protecting the Smart City from Cyber Attack”. If you are working on an IoT or cyber security project, you should attend as there will be lots of good discussion and you will get an insight into the many risks of and considerations for the numerous aspects of a secure smart city.

Here is my discussion outline:

This session will discuss the approaches that must be considered by policy makers, technology companies, and city managers when assessing new technologies to be deployed as part of the smart city infrastructure. Cities do not want to be attacked nor have their devices used to attack other cities or foreign governments. It will take planning and foresight to reduce these risks. Standards are being developed that will help with both architecture aspects and how to assess the security and privacy risks.

Hope to you see you there and don’t forget to bring your questions!

0
Nov
21
2016
Cyber Security Secure By Design Secure Coding

Saw this post today about programmers discussing the unethical and illegal things they’ve been asked to do and it really made me think about all the battles I had as a young cyber security practitioner. Fortunately I was very fortunate in that I had lots of support and worked for an organization who respected security at the onset of my career in cyber security more than 20 years ago. This helped me when I experienced the other side of the coin where executives wanted things like breaches covered up and threaten you with lawsuits if you refuse to obey or speak out….. And yes that happened to me once.  The choices that I made then and throughout my career were and still are shaped by those experiences and my ethics.

Five years ago Marc Andreessen penned his famous “Why Software Is Eating the World” essay in The Wall Street Journal. Today software is feasting on the world; its footprint is in our businesses, our smart phones, our physical activities, leisure and even sleep. This footprint is only going to grow exponentially with the Internet of Things (IoT) as are the opportunities for those with less principles or ethics to take advantage especially in terms of unethical coding and the misuse of the treasure troves of data that many companies are custodians of today.

Companies who are data custodians but do not have the required cyber security for their customer’s data, either through negligence and incompetence, are doing a disservice to their customers. However, despite the rash of data hacking in recent years, it is not all negative. More and more executives appear to have turned the corner and are now willing to listen and learn about how to better protect their companies and their customer’s data. Moreover, I strongly believe that relatively new legislation such as PIPEDA in Canada will motivate many companies to not just think about meeting a requirement but how to better secure their organizations. Believe it or not being cyber secure is, and will be, a differentiator in many markets as those who are unwilling to invest in better cyber security will do so to the detriment of their customers, shareholders and themselves. Going forward executives will be in the cross hairs of data breaches and will have to own up to any oversight on their part in terms of cyber security and the protection of their customer’s data.

That said my advice to all employees is to protect yourselves. Ensure that requests to perform unethical activities are recorded with data, time, and people — record, who, why and what and remember to keep your journal encrypted. If you are asked to do something that is completely illegal contact a lawyer and report it to the relevant authorities. If and when you leave the organization for these reasons make sure you report it during your exit interview. You ethical duty is to make them aware of it and that you have recorded all aspects of the activity. It is then up to them to deal with it as it is their responsibility to ensure secure software.

0
« Previous Page — Next Page »