-: Internet of Things Vulnerabilities.
In this lesson, we're going to start talking about
IoT, or the Internet of Things.
Now, when I talk about Internet of Things,
you may have heard this term before,
and you really should if you've talked about
A+, or Net+, or Security+,
because these are all things that connect to our network.
It can be things like trains, planes, and automobiles.
It can be shopping carts.
It can be your Smart TV.
It can be your cell phone.
Pretty much anything that can connect to the Internet
could be considered an Internet of Things.
For instance, there's some refrigerators out there right now
that have the ability of connecting to the Internet
and using things like Alexa
to be able to add things or take things away
from your shopping list.
All of that is part of the Internet of Things.
So, when we define the Internet of Things, or IoT,
we're really just talking about a group of objects,
and they could be electronic or not,
and they all have to be connected to the wider Internet
by using embedded electronic components.
That is what we define the Internet of Things.
So, if you think about your home, if you have a Smart home,
you might have a Smart door lock on the front door
that you use to get in.
You have a camera that's sitting there
to see people as they come up to your doorbell,
and if they press on your doorbell,
that can actually ring on your cell phone
so you can know who's at the door
before you get up from your couch.
You might have a Smart air conditioner
that can keep track of what the temperature's in the room,
and you can set it and you can change it
from anywhere in the world because it's Internet-connected.
You might have a lighting system
where you can control if it's going to be
white, or red, or blue lights,
because they're connected to the Internet, too,
and you could talk to that through your smartphone.
You may have energy management or appliance control.
You might have a smart device
like a Smart TV, or a Smart speaker.
All of these things are different things
that we can connect inside of our house,
and they all give us a lot of great capability.
But the biggest problem with these things
is they're not always secure,
and security is most often an afterthought to convenience
when we start talking about smart devices.
Now, most of our smart devices are going to use
an embedded version of Linux or Android
as their operating system.
And so, because they have Linux or Android
as their operating system, they are vulnerable to attack.
If there's a Linux vulnerability out there
and you're using a Linux version on that smart device,
and that vulnerability matches,
it can actually attack your Smart speaker, for instance.
And so, these are things you have to think about
as you start looking at your network,
because if they're connected to your network,
'cause you have a Smart TV in the conference room,
that could be an attack vector
for somebody to get into your network.
And that is one of the most common places
I see people getting into a network through,
is things like smart devices
that are now connected to the corporate network.
So, you want to make sure they're properly installed,
secured, and segmented when you put them
into your corporate network,
if you're going to put them in your corporate network.
Now, these smart devices must be secured and updated
when there's new vulnerabilities that are found.
As I said, they're just running Linux or Android.
And what happens is a lot of times,
people will never update the software on these devices.
So, you might be running a version of Linux
that's five years old
because it was small and easy to put on a device,
but you've never updated
so now it's got this huge vulnerability.
So, when you think about IoT,
the idea of IoT and security,
they really don't go together very well
because most IoT manufacturers
are not thinking about security
when they build these devices.
People buy smart speakers, and lights, and smart devices
because they want convenience.
And most people aren't thinking about security.
So, if you're going to install these things
in your corporate network,
you really have to think about this with a security lens.
And one of the best you can do
is segment these devices off into their own network
so they're not talking to the rest of the corporate network.
Don't allow them to be a device
that people can use to be able to pivot into your network
and get your corporate data.