#HITBGSEC
PRESENTATION MATERIALS:
http://gsec.hitb.org/materials/sg2015/
PRESENTATION ABSTRACT:
By 2020, the world will be home to 50 billion connected devices. With five connected devices per person by 2017, the exponential rise of the Internet of Things (IoT) poses challenges for today’s security professionals. For example, a recent HP Study found 70% of IoT devices contained security exposures, allowing an attacker to identify a valid account through account enumeration. While network security is relatively understood, securing devices that run on an embedded computer with network access is new territory.
Most companies assume that their current BYOD policy also covers IoT devices, but they are largely mistaken. New attacks bypass these policies everyday. In the IoT there is no concept of network access control, vulnerability assessment, or intrusion detection. These connected devices create their own network, and there are many protocols that cannot be detected with traditional WiFi scanners. Because of this, IT administrators have no visibility into where they are, what they are doing, and whom they are talking to in the network.
The first step in preventing a potential IoT security nightmare is having visibility into a corporate airspace to identify all IoT devices, which can be used as threat vectors. This interactive session will walk the audience through the discovery of known, unknown, and ‘ghost’ devices from DC to 10GhZ of the electromagnetic spectrum via simulations and real-time audience engagement. The purpose of this is exercise is to create a visual of the infiltration of connected devices in the airspace and understand associated vulnerabilities.
After exploring the array of devices in the airspace, and the possible security disasters that can result from them, we will discuss the techniques organizations can utilize to discover IoT devices in their airspace and defend the network from an airborne attack.
The target audience for this presentation is enterprise security professionals and risk officers. The interactive session will utilize live demonstrations and scenarios that bring the threat of IoT devices to life and examine how the enterprise can identify these devices and create an IoT network defense policy. The talk is interactive in nature and should benefit anyone who is tasked with protecting information networks, mission critical data, and human and physical assets in today’s rapidly evolving modern threat environment.
ABOUT CHRIS ROULAND
Chris Rouland founded Bastille Networks in 2014 after more than 25 years in the information security industry. Most recently, Chris founded Endgame Systems, which provides cyber security solutions to the defense, civilian and national security communities. As founder and CEO of Endgame, in just three years, he grew the company from his basement to nearly 100 employees with offices in Washington, Atlanta and San Antonio and from revenues of $0 to more than $10 million. Chris also put together a world-class team of investors and board of directors investing over $58 million in venture capital – making Endgame a name brand in cyber security. His innovation and leadership combined with Endgame’s rapid growth, earned Chris the Metro Atlanta Chamber’s Business Person of the Year in 2011. Prior to founding Endgame, Chris served as chief technology officer at Internet Security Systems Inc. (ISS) where he was responsible for the overall technical direction of its product and services portfolio. In 2006, IBM Corp. purchased ISS, where Chris remained CTO and was appointed an IBM Distinguished Engineer. From 1994 to 1998, Chris served as vice president of distributed technology at Lehman Brothers. A noted information security expert, Chris is a sought after speaker and has been featured in national publications, including Forbes and Wall Street Journal.