AppSec Labs Internet of Things (IoT) Security

Smart and connected devices (IoT) are transforming our lives, improving efficiency, availability and security of our environment and life. Smart cities, smart medicine/healthcare, smart homes, smart transportation and smart manufacturing are changing the way we communicate with our environment, homes and even our bodies. AppSec Labs’ IoT Research and Evaluation Over the last few years we, at AppSec Labs, did a lot of research on connected device threats and mitigation. The research was done side-by-side with consulting and accompanying the development of new connected products and old-fashioned devices that became connected. We have helped teams develop secure solutions, and developed different tools and scripts to attack insecure usage and implementation. AppSec Labs IoT Partnerships AppSec Labs is a Microsoft Global trusted partner in the security program for Azure IoT, this partnership provides AppSec Labs with access to the newest Microsoft solutions and direct access to R&D, which is knowledge we transfer to our customers. Whether you’re building your own solution with certified devices or looking for a complete IoT solution, AppSec Labs can help tailor the Azure IoT Suite to your industry-specific needs. AppSec Labs has partnered up with leading IoT architects & development teams including Softimize and Emind. These partnerships allow us to stay one step ahead of the game and give us the opportunity to be in the first line with the best IoT providers – all the way from the designer table to production. Connected Device – the Ultimate Problem to Protect IoT products have two big issues that require wide and specialized expertise to secure: A larger attack surface:

• Local device (sensors and/or controllers)
• Mobile apps (iOS and Android)
• Cloud APIs
• Management website

Custom architectures and communications:

• Multiple entities and identities
• Multiple authentications in one product
• Non-common protocols
• Device initialization (network connection and pairing)
• Mobile ⇔ device communication
• Protecting client-side code (mobile apps and device)