Security in Internet of Things Begins with the Data Daniel W. Engels, PhD Associate Professor, CSE, Southern Methodist University Director, SMU Master of Science in Data Science Program

The Internet today Source: Opte Project

What is IoT? First mentioned in 1999 by the MIT Auto-ID Center. IoT meant to “create a universal environment in which computers understand the world without human intervention.” IoT was simply the tool that would be used to merge the worlds of bits and atoms. Over 15 years after its inception, IoT is now seen as a modern, fresh concept in our connected world…with many different definitions.

Internet of Things (Dragon Files) Merging of the physical world with the virtual world in order to give virtual lives to inanimate objects, ideas and concepts and through those lives to impact both the physical and the virtual lives of man, machine and things. Disembodied Intelligence Augmented Reality Automation 6th Sense of World Monitoring Distributed Control Augmented Virtuality Improved Visibility Ant-like Intelligence

Billions of Things are Already Connected to the IoT! Internet of powered devices Internet of powered things Connected by Internet of everyday things Connected by Slide courtesy of Evanhoe and Associates

IoT Last Mile Technology Standards WirelessHART (IEC 62591) NFC 6LowPAN (IETF RFC 4944) ISO/IEC 18000-3 IEEE 802.15.4 ISO/IEC 18000-6 ISO/IEC 18000-7 (ITU-T G.9959) Contiki (ISO/IEC 14543-3-10)

Two Paradigms for IoT are Emerging Brain-Body Merge – intelligence is added to everyday things in your world, so that your life can be more awesome. Head in the Clouds – identification and wireless connectivity is added to everyday things in your world and intelligence is supported in the cloud, so that your life can be more awesome.

Brain-Body Merge HRP-4C Robot

Head in the Clouds

Internet of Things

Potentially Trillions of Tag Reads per Day with basically zero security on the tags (This is the definition of BIG DATA!)

Big Data can violate your privacy without any one piece of data violating your privacy. Connecting bits and atoms using IoT promises to create Huge Data.

Do you Trust your IoT Data & Collector? do you trust the data you are collecting and/or using? do you trust who is collecting the data from you?

What Went Wrong? The BARCODE was designed to SHARE information The RFID TAG was designed to SHARE information The IoT System was designed to SHARE information NETWORKS were designed to SHARE information Security was an AFTERTHOUGHT (what are the security threats?) (and it continues to be an afterthought today)

The edge of the network continues to expand and become mobile The edge of the network continues to expand and become mobile. Devices are introduced to fill some benefit. Once the number of edge devices are sufficiently large or a significant security breach occurs, security is added. Security is always an afterthought, especially as devices become smaller, cheaper, and less powerful. The new edge, epitomized by the Internet of Things, is here today and is following the same deploy, realize benefit and then secure paradigm. The problem is that these new edge devices cannot use the security developed for the old edge devices. Therefore, new security mechanisms are required.

It’s all about the data!™ The IoT technologies have been around for a long time Advances in communication and connectivity are allowing the “interconnectedness” needed for IoT The value is in the data not the connections The data allows you to make autonomous decision based on business rules closer to the edge Slide courtesy of Evanhoe and Associates

(Some) Big Data Security Challenges Data Confidentiality Privacy Preserving Data Correlation Personal and population privacy Privacy enhancing techniques Data service monetization Data publication Privacy implication of data quality Data ownership Data lifecycle management

Final Thoughts IoT has been widely deployed with limited to no security. As massive amounts of data are being collected, stored, manipulated, merged, analyzed, and expunged, security and privacy concerns will have begun to explode. Need scalable and practical solutions to Big Data Security and Privacy as well as applying Big Data Management and Analytics for Cyber Security. Need to develop technologies guided by policies to address security and privacy issues throughout the lifecycle of the data. Need to understand not only the societal impact of IoT and its ubiquitous data collection, use and analysis, also need to formulate appropriate laws and policies for such activities.

Do You Feel Lucky?

Thank You

Questions ???

No Device is an Island Every networked device is an entry point into your network (DATA ATTACKS!) No device is to be fully trusted by any other Every device is a city state to be protected

Policy Standards Procedures, Guidelines & Best Practices Mechanisms and Monitoring Actual Operations & Environment