-: Our final category of vulnerabilities
is the Internet of Things.
And so, the internet of things is three fold.
Really, we're talking about consumer devices
and smart TVs and smart home devices, that's one category.
We have SCADA and we have ICS.
So, lets talk about smart TVs and consumer devices.
This is something that is a big threat inside your networks,
both in the office as well as at home.
Because you have things like smart TVs,
you have thermostats, you have smart refrigerators
nowadays, you have those Amazon Alexa things,
and the Dots, and the Echoes, and the Google Assistants,
and all of these smart things out there
that all connect to the internet.
Now, how often are these devices
actually patched and updated?
Not very often, and so if you have something like a wireless
printer, that's something you've gotta be concerned about.
A thermostat, that's something you gotta be concerned about.
Any of these smart devices in your home, the TVs,
that's something that you gotta be concerned about.
When's the last time that firmware was updated and patched?
Again, some of your scanning tools
will be able to find these on the network
and will tell you what vulnerabilities exist.
One of the big ones out there if you look at something
like Shodan, they find wireless web cams all the time
that are on these networks as part
of the Internet of Things and they're just
vulnerable and open and so you gotta be careful with these.
You gotta make sure you check those vulnerabilities.
The next one, which is actually one that
scares me even more is SCADA which is
Supervisory Control and Data Acquisition Systems.
These are the devices that you'll find in power plants,
these are the devices you'll find in factories,
and other control system type areas.
And all of that data comes back to a central dashboard
so one guy can be sitting in a central panel
monitoring all the temperatures and the pressures
and all of that kinda good stuff,
and that reaches out to these sensors all over the plant.
Well, how often is that system being updated?
How often is it being patched?
Probably not very often, right and so it falls
into this Internet of Things category.
Again, those things should be segregated
out of your network into a stand alone network
that's not touching the internet preferably,
so that they're more protected.
And if not, you need to make sure that
they're being scanned frequently for vulnerabilities
and make sure that they're part
of your vulnerability management program
if they're gonna be touching the internet.
The next one we're gonna talk about,
and the last one we're gonna talk about here
is the ICS, or Industrial Control Systems.
Very much like SCADA, where we're dealing with
this supervisor control, ICS on the other hand
is dealing with things like pumps,
and pressures, and valves, and those things
can all be controlled by a computer on the network.
Again, if you're on the network you're vulnerable
so we have to have that as part
of our vulnerability management system as well.
These things are hardware devices
with a piece of firmware embedded in them.
That firmware does not get updated very often,
either by the manufacturers or even if it does
by the manufacturer's how often do you go
and do a patch update on your valve?
Not very often, right?
Probably never.
These things get installed once, and they stay
in service for 15, 20, 30 years.
This is another big security concern that
you have to be thinking about.
When we start talking about ICS and SCADA,
you can look back over the last couple of years
and there have been attacks on the power grids
in foreign countries, such as in the Ukraine power grid
back in, I think it was 2015.
There's been other ICS, SCADA issues in factories
and elsewhere around the world.
These are a concern and if you run a factory,
a power plant, any of these type of systems
that use ICS and SCADA just remember,
this is part of your network and you
do have to consider it as part of your
vulnerability management program.