- In this lesson, we're going to focus on another type
of embedded system called the Internet of Things, or IoT.
Now the Internet of Things, or IoT,
refers to a network of physical objects, or things,
embedded with sensors, software,
and connectivity that enable them to exchange data
with other connected devices,
and interact with users over the Internet.
Sometimes we use the term smart devices to refer
to that ability to interact
with our users over the internet.
Now there is another internet
of things you might not be as familiar with.
It's called the IIoT.
It's the Industrial Internet of Things.
And that refers to the application of IoT technology
and principles in industrial settings
with the goal of improving
efficiency, productivity, and safety.
Now, so it refers to the use of connected sensors
and devices and machines in manufacturing, in logistics,
and in other industrial settings to collect,
analyze, and share data in real time.
Both IoT, Internet of Things, and IIoT,
Industrial Internet of Things, have four components.
They have an embedded system.
They have sensors.
They have an actuator.
And they have a wireless transceiver.
Remember that an embedded system,
we talked about this in the last lesson,
includes a microprocessor, an RTOS,
real-time operating system,
and software designed to perform a specific task.
And that microprocessor we refer to really as a SOC,
a system on a chip.
A center is a component that detects and responds to changes
in the environment.
An actuator is a component that takes the electrical input
and turns it into a physical action.
And a wireless transceiver is a component that can send
and receive radio frequency, that's RF,
signals over the air.
Now it could be NFC, near field communication,
WLAN, RFID, or GSM, in this case cellular.
So, let's look at some IoT and IIoT examples.
Wearables, IoT enables fitness trackers and smart watches,
right, that can monitor various health metrics such
as your heart rate and provide all kinds of insights
to help people make informed decisions
about their health and wellness.
We have IoT devices in our homes,
so we can have smart homes, smart thermostats,
smart lighting, smart security systems,
which allow homeowners to control
and automate their home systems automatically.
In the IIoT world, we've got things like smart agriculture.
IIoT sensors are used in agriculture
to monitor soil moisture,
temperature, and other environmental factors
to optimize crop yield, reduce water usage,
and increase efficiency.
And in an industrial setting, right,
manufacturing to monitor and optimize processes,
improve efficiency, and to reduce downtime.
I want to next introduce you to the concept
of edge computing and how it interacts with IoT or IIoT.
Edge computing is a deployment of data handling activities
and operations at or close to the source
without having to go through centralized network segments.
Now depending on the device,
or the equipment being considered,
that network edge can refer to the area
where the device communicates with the internet.
So, for IIoT or IoT devices, such as a smart camera,
with the network edge will actually be the processor
within the camera.
Now, smart edge devices are equipped
with features for capturing data and processing.
So, this all sounds great, right?
We've been talking about embedded systems,
ICS systems and its SCADA systems,
and now IoT systems and IIoT systems.
Is there anything that we should be worried about?
Well, there's a lot of IoT vulnerabilities.
IoT devices are vulnerable largely
because the devices lack really
often built-in security controls
and configures to counter threats.
Now, why is that?
Well because very often there's a rush to market.
Right, when an IoT device is being developed,
it's let's get it out there,
let's get it to market with a focus on marketability,
focus on price, focus on usability,
focus on being first to market,
and very often with an afterthought, if any, right,
about security.
So, IoT devices are certainly a concern.
Now, the nice thing is IoT devices
because they're specifically designed
not to be in a home environment or personal use,
but to be in an industrial or corporate environment,
generally will have more attention paid to security
and will have more security options.
Now, some common vulnerabilities
that you should be watching out for whether it's IoT,
or IoT include firmware vulnerabilities
which really is an embedded device issue,
default or weak passwords, right,
so are you still using the default password?
Can you change it?
I hope you can or is it just a weak password
maybe single factor just you know can't do anything else
to enhance it?
A lack of encryption?
The use of insecure protocols,
so example using Telnet instead of using SSH.
A lack of security updates.
Minimal, if any, logging and alerting capabilities.
And then of course supply chain attacks,
including introducing malicious code.
Because when we're thinking about IoT or IIoT,
I always want you to remember that we're also talking
about an embedded system.
And that, my friends, brings us to a three-second challenge.
Five challenge questions, three seconds each.
Let's do it.
Component that detects and responds
to changes in the environment.
One, two, three.
That's a sensor.
Number two, commercial application of IoT technology.
One, two, three.
That's going to be IoT,
or the Industrial Internet of Things.
Number three, the device that's able to connect, share,
and interact with its user.
One, two, three.
That's referred to as a smart device.
Number four, components of an embedded system.
One, two, three.
Remember, there are three components.
One, two, three.
We have a system on a chip, SoC.
We have an RTOS, it's a real-time operating system.
And then we have the application software.
And lastly, number five,
component that sends and receives RF signals
over the air.
One, two, three.
And that's going to be a wireless transceiver.
All right, my friends,
that brings us to a security in action,
so we can apply our knowledge.
And this one's about smart buildings, IIoT.
Your organization is building a new data center,
and we're exploring IIoT smart building options,
including smart lighting, smart doors, and smart elevators.
Now, you've been asked to be on the exploratory task force,
and have volunteered to create a checklist
for evaluating products and vendors.
So, what are you gonna include?
And so, we've got this new data center being built.
You want it to be a really cool smart building,
an IIoT smart building.
It's gonna have smart lighting, have smart doors.
It's going to have smart elevators.
and this exploratory task force,
because this is a whole new thing, right?
You're on, and you volunteered to create this checklist.
This is, okay, when we start evaluating our products,
smart lighting, smart doors, smart elevators,
what should we look at in terms of the products
and the vendors?
So put me on pause. Go ahead and write up a little checklist
of what you would include.
And come on back,
and we'll go through them together.
Well, let's start at the top, our supply chain, right.
We wanna know what is the source
of the embedded chips and software.
Where did they come from?
Because we're really concerned about those chips.
We wanna make sure that the old chips aren't being used,
that chips that have known
vulnerabilities aren't being used,
maybe chips that can't be upgraded aren't being used,
as well as the software, the operating system software,
the RTOS.
Is it open source?
What kind of open source is it?
How old is it, right?
So, we really want to understand, you know,
where is the embedded chips and the software coming from?
And that's going to be going down our supply chain.
We want to be asking questions
about what's the available security controls
for authentication, encryption, visibility, or monitoring.
And how about patch management in terms
of any firmware updates?
We want to look at privacy controls,
about what data is gonna be shared,
because data is gonna be collected.
So, what data is gonna be shared and with whom?
Security testing, both what the vendor has already done
and what your organization can do to test the security
of these devices.
And then we want to research,
and review all available vulnerability intelligence,
and compromise history related to both the IoT devices,
and to that vendor.
Being able to create this kind of checklist
and then going ahead and doing it,
that's really cool stuff because you're gonna move
your organization into the next generation of buildings.
But we always want to be cognizant
of the potential vulnerabilities and security issues.
And by understanding them better
and really putting our requirements in place,
that allows us to minimize the risk to our organization.
And doing that, well, that's definitely security in action.
There's your word cloud.
It's not too big,
but make sure you know all of these before you move on.
And what we're going to move on to is a 10-question quiz.
So, I'll see you there.