Secure and Control IoT
Cisco IoT System Security
November 17, 2015
Our Panelists
Vikas Butaney
Sr. Director, IoT Systems Group
Cisco
Tyler Shields
Principal Analyst, IoT Security
Forrester Research
Agenda
IoT Security Today
Forrester Viewpoints
Cisco IoT System Security
Customer and Partner Perspectives
Questions and Answers
IoT Is Expanding
Accelerating New Product
Introductions
Reduced
Truck Rolls
Increased Use of Public
Transportation
Improved Supply
Chain Efficiency
Increased
Grid Reliability
Improved
Citizen Safety
Experienced
Security
Risks
Source: Forrester –
Security, The Vital
Element of IoT; Q1 2015
Increasingly
Hostile
Threats
Source: Dept. of Homeland
Security; ICS-CERT
36%
47%
46%
Deployed and
Expanding IoT today
Disclosed ICS
Vulnerabilities*
Planning to Expand in
Next 3 Years
23
149
Stuxnet
High Profile Attacks
2005
Have Experienced a
Security Breach
Black
Energy
2010
963
Havex
2015
IoT Security Challenges
Scalable Threat
Management
Simplified
Compliance
Visibility
Everywhere
Detect,
Remediate, Adapt
Manage and Enforce
Policies Centrally
OT Context: Fog to Cloud,
Devices to People,
How IT and OT are Addressing IoT
› We want to focus today specifically on how IT and OT
(operations technology) teams are trying to come
together to implement IoT solutions and, oftentimes,
coming up short
© 2015 Forrester Research, Inc. Reproduction Prohibited
7
Iot Security Is No Longer an
Issue That Organizations
Have to Embrace Sometime
in the Future — It Is Here
and It Is Now.
Growth in IoT Functions
are Occurring in Traditional OT Areas
“Based on your understanding of the ‘intelligent connectivity
of physical devices’, please select the functions you believe
are delivered by these solutions.” Select all that apply
“What types of functions that enable "intelligent
connectivity of physical devices" is your firm deploying
or planning to deploy?” Select one
Infrastructure Management
68%
Industrial Applications
61%
Energy Management
60%
Building and Home Automation
55%
Environmental Monitoring
54%
Transport Systems Management
53%
Enhanced Customer Service/Interaction
50%
36%
32%
47%
41%
36%
24%
47%
42%
32%
29%
38%
44%
37%
47%
Perception Is Focused47%
on OT (Infrastructure,
Medical and Healthcare Systems
31%
29%
Industrial, Energy Systems). REALITY IsDeployed or expanding deployment
Focused on OT and CUSTOMER SERVICE!
Planning to deploy within five years
Base:336 Internet of Things decision makers
Source: A commissioned study conducted by Forrester Consulting on behalf of Cisco, November, 2014
Yet IT Controls the Vital
Elements Necessary to Enable IoT
Without IT – IoT Is Useless and Eventually So Is Your Business
“Please rate the following
technologies on how necessary each
element is to enable the “intelligent
connectivity of physical devices” in
your organization”
Important or Extremely Important to Bring
Value (4 or 5 on 5 point scale)
Wi-Fi
Security sensors
Condition sensors
GPS tracking
Real time location tracking
Barcodes
CDMA/GPRS/4G
Grid sensors
Telematics
Mesh Networks
Near Field Communications…
Passive RFID
Base:336 Internet of Things decision makers
Source: A commissioned study conducted by Forrester Consulting on behalf of Cisco, November, 2014
71%
65%
63%
61%
60%
58%
52%
52%
50%
49%
48%
46%
Experiences With Security
Breaches in IoT Functions
Are Giving Decision-makers
a Moment of Hesitation.
Firms Experience Security
Breaches in IoT Areas
IoT Security Breaches Are Already Here. Don’t Be Fooled By
“It Won’t Effect Me!”
“Has your firm
experienced a
security breach for
any of the following
functions?”
Industrial Applications (n=105)
Medical and Healthcare Systems…
Enhanced Customer…
Infrastructure Management (n=120)
Environmental Monitoring (n=106)
Building and Home Automation…
Transport Systems Management…
Energy Management (n=121)
Base:336 Internet of Things decision makers
Source: A commissioned study conducted by Forrester Consulting on behalf of Cisco, November, 2014
47%
44%
44%
40%
39%
38%
35%
28%
And Threats Will Remain in the Long Term
IoT Security Issues Will Not Be Solved in the Next 5 Years.
They Will Only Get Worse.
External hackers (n=257)
“As technology progresses and
enterprises develop practices to prepare
for the “intelligent connectivity of physical
devices,” do you feel the following
security and privacy risks will remain
prevalent in five years or longer?”
37%
Viruses, network worms, and other
malicious software (malware)…
33%
Safety of human life (n=231)
32%
Leakage of sensitive or confidential
data (n=273)
31%
Internal hackers (n=175)
Denial of service attacks to
intelligent devices (n=209)
Physical compromise due to
intelligent device failures (n=230)
Third party collection of device
usage patterns and data from…
Lack of authentication and
authorization for access to these…
Base: Internet of Things decision makers who rate the security / privacy risks as important
Source: A commissioned study conducted by Forrester Consulting on behalf of Cisco, November, 2014
30%
28%
26%
26%
18%
No Surprise That Security Is Top of Mind and
Remains a Challenge
Security Is the Biggest Challenge and the Most Important
Factor When Deploying IoT Solutions
76%
Security solutions
“Please rate the following elements
based on how important and how much
of a challenge each element is to
implementing applications and solutions
that use the “intelligent connectivity of
physical devices” in your organization”
Rate on a 1 to 5 point scale, showing Top
5 in Importance
Networking requirements
58%
73%
56%
73%
Infrastructure
Data analytics
Systems integration
services
58%
71%
48%
68%
55%
Importance (4 or 5 out of a 5-point scale)
Challenge (4 or 5 out of a 5-point scale)
Base: 336 Internet of Things decision makers
Source: A commissioned study conducted by Forrester Consulting on behalf of Cisco, November, 2014
Summary and Recommendations
Security Remains a Problem for IoT Partially Due to the
Challenge of Bridging the IT and OT Architectural Models
Decision Makers Must Prioritize Security As Mission-critical
When Deploying IoT in Their Firms
When Addressing Security, Both IT and OT Must
Work Cohesively
Cisco IoT System
APPLICATIONS
Network
Connectivity
Fog
Computing
Data
Analytics
Security
Cyber and
Physical
INTERNET OF THINGS
Management
and Automation
Application
Enablement
Platform
Breaking Through the Challenges
APPLICATIONS
OT-centric Security
Network
Connectivity
Fog
Computing
IoT Network as a
Sensor and Enforcer
Data
Analytics
Security
Cyber and
Physical
INTERNET OF THINGS
IoT Physical
Security
Management
and Automation
Application
Enablement
Platform
Cisco IoT System Security
OT-centric
Security
ISA 3000
Fog Data Services
IoT Network As a
Sensor and Enforcer
IoT
Physical Security
IR Portfolio
ISE
3000 and 6000 Series
WDR IP Cameras
IE Portfolio
ASA H
ICPAM
Physical Access Control
IoT Security Services
Advantages of Cisco IoT System Security
OT Specific Threat
Management
Security
at Scale
Comprehensive
Scope
OT context – built on
industry leading
ASA/
FirePOWER
services software
Extends network as
a sensor and
enforcer to IoT
OT/IT security,
physical security,
and services
Industry Example – Manufacturing
Application Visibility and Control
Ensure operational safety
and compliance
Gain application visibility,
control access and manage
threats
Factory proven - Cisco
Validated Design (CVD)
Industry Example – Utilities
Simplify NERC-CIP Compliance
Segment network and
manage audit scope
Gain application visibility,
control access and manage
threats
Utility proven
Cisco Validated Design
(CVD)
Cisco IoT System Security in Action
Protect Critical Infrastructure
Malicious
contractor
attempts to
damage SCADA
system within
substation
Critical infrastructure
protected
Context aware enforcement
prevents system damage
Cisco IoT System Security Delivers
Manufacturing
Energy
Transportation
Accelerated Deployment With Industry Specific Cisco Validated Designs
Market Viewpoint
“The industrial market is demanding scalable security to move faster with IoT. These OT
ready products and offering security everywhere across the IoT network solve the critical
need—ensuring system availability and simplifying compliance.”
—Shawn Rahn, VP IoT Presidio Systems
Summary
OT-centric
IoT Network As a
Sensor and Enforcer
IoT
Physical Security
OT Threat
Management
Simplified
Compliance
Comprehensive
Risk Mitigation
Next Steps
1
Learn more about Cisco IoT
System Security
2
Cisco IoT System Security
resources
Download the IoT
Pl Security white
paper
3
Cisco IoT System white paper
:
Assess your specific threats and risk
IoT threat tools