Tag Archives: Security

46

Rob Tiffany Rescues IoT

Welcome to IoT Coffee Talk🎙️46 to chat about Digital #Tech #Analytics #Automation #IoT #DigitalTwins #Edge #Cloud #DigitalTransformation #5G #AI #Data #Industry40 & #Sustainability over a cup of coffee.

Grab a cup and settle-in with some of the industry’s leading business minds and technology thought leaders for a lively, irreverent, and informative discussion about IoT in a totally unscripted, organic format.

This installment also happens to be the longest one following up the shortest episode we have every recorded. Rob walks us through his view on how to rescue IoT. Great insights for startups and how to hone in on IoT value.

Click below to check out IoT Coffee Talk wherever you get your podcasts:

Thanks for listening to us! Watch episodes at http://iotcoffeetalk.com/. Your hosts include Leonard Lee, Stephanie Atkinson, Marc Pous, David Vasquez, Rob Tiffany, Bill Pugh, Rick Bullotta and special guests.

We support Elevate Our Kids to bridge the digital divide by bringing K-12 computing devices and connectivity to support kids’ education in under-resourced communities. Please donate.

IoT Coffee Talk

“IoT Security Part 2”

Welcome to IoT Coffee Talk🎙️21 to chat about #Digital #Tech #Security #Automation #IoT #DigitalTwins #Edge #Cloud #ArtificialIntelligence #5G #AI #Data #Industry40 #SmartCities & #Sustainability over a cup of coffee.

Grab a cup and settle-in with some of the industry’s leading business minds and technology thought leaders for a lively, irreverent, and informative discussion about IoT in a totally unscripted, organic format.

On this week, Stephanie Atkinson (Compass Intelligence), Rick Bullotta (IoT Guru), Marc Pous (balena.io), David Vasquez (Verizon), Leonard Lee (neXt Curve), and Rob Tiffany (Ericsson) to once again discuss the massive topic of IoT security. Why is it such an issue? Why is there such a huge gap? What do we need to do to secure IoT end to end?

Listen here or wherever you get your podcasts:

Thanks for listening to us! You can also watch episodes at http://iotcoffeetalk.com/.

Please support our non-profit, Elevate Our Kids to bridge the digital divide by delivering K-12 computing devices and Internet connectivity to support kids’ education in under-resourced communities. Please donate to this important cause.

15

“IoT Security”

Welcome to IoT Coffee Talk🎙️15 to chat about Digital #Tech #Analytics #Automation #IoT #DigitalTwins #Edge #Cloud #DigitalTransformation #5G #AI #Data #Industry40 & #Sustainability over a cup of coffee.

Grab a cup and settle-in with some of the industry’s leading business minds and technology thought leaders for a lively, irreverent, and informative discussion about IoT in a totally unscripted, organic format.

On this week’s episode, Stephanie Atkinson (Compass Intelligence),  Leonard Lee (neXt Curve) and Rob Tiffany (Ericsson) discuss the challenges of security for IoT. Find out about Cylons hacking Cylons and the security risks and costs of Seven Sigma!

Click below to check out IoT Coffee Talk wherever you get your podcasts:

Thanks for listening to us! Watch episodes at http://iotcoffeetalk.com/. Your hosts include Leonard Lee, Stephanie Atkinson, Marc Pous, David Vasquez, Rob Tiffany, Bill Pugh, Rick Bullotta and special guests.

We support Elevate Our Kids to bridge the digital divide by bringing K-12 computing devices and connectivity to support kids’ education in under-resourced communities. Please donate.

IoT Coffee Talk

“Open Source IoT Security”

#IoT Coffee Talk🎙️61 #TechNews about #Digital #CyberSecurity #Automation #DigitalTwins #Edge #Cloud #5G #AI #Data #Industry40 #SmartCities #Telecom #Mobile & #Sustainability

Grab a cup and settle-in with some of the industry’s leading business minds and technology thought leaders for a lively, irreverent, and informative discussion about Tech in a totally unscripted, organic format.

In this installment, we discuss open-source technologies and security. Are open-source technologies more secure? If so why?  If not, why not? We explore what constitutes IoT security and the impact, if any, that open-source plays in making it better or worse.

Click to listen here or wherever you get your podcasts: You can also watch this episode on YouTube.

Please support our non-profit, Elevate Our Kids to bridge the digital divide by delivering K-12 computing devices and Internet connectivity to support kids’ education in under-resourced communities. Please donate to this important cause.

IoT Coffee Talk

“Ransomware Attacks”

#IoT Coffee Talk🎙️59 #TechNews about #Digital #CyberSecurity #Automation #DigitalTwins #Edge #Cloud #5G #AI #Data #Industry40 #SmartCities #Telecom #Mobile & #Sustainability

Grab a cup and settle-in with some of the industry’s leading business minds and technology thought leaders for a lively, irreverent, and informative discussion about Tech in a totally unscripted, organic format.

In this installment, we talk about the accelerating problem of ransomware attacks that are slowly dismantling the world of digital transformation. We discuss how our fixation on getting “innovations” out faster to market in larger volumes is creating massive holes in security. Maybe it is time for us to protect that which is most critical by going Battlestar Galactica style to fend off the Cylon attack.

Click to listen here or wherever you get your podcasts: You can also watch this episode on YouTube.

Please support our non-profit, Elevate Our Kids to bridge the digital divide by delivering K-12 computing devices and Internet connectivity to support kids’ education in under-resourced communities. Please donate to this important cause.

IoT Day Slam 21: Securing IoT Data at the Edge

Security concerns are listed as one of the top blockers to IoT adoption and devices continue to be the weakest link in the IoT ecosystem.

Most customers are relying on IoT #data platforms to provide some level of protection. IoT device management platforms are underutilized with many legacy devices incapable of being patched or updated. In this session, I describe a different method of delivering IoT security that leverages networks and edge computing.

Twin Buildings

The Digital Twin Instance

It’s time to create a Digital Twin Instance of a physical entity that is derived from a Digital Twin Model.

If you’ve worked with any of the Internet of Things platforms, you probably registered an IoT endpoint or device to make its identity known to the system. In the smallest way possible, this is what it means to create an instance of your digital twin that is entangled with a physical entity.

Like most things in the digital world, you start with Identity. You give your digital twin a name & perhaps a brief description. The IoT platform you’re working with will assign a unique identifier used to access & identify the digital twin and its physical counterpart throughout its life cycle. Next, some type of security token or X.509 certificate will be bound to the unique identifier of the digital twin in order to facilitate authentication & authorization. It’s possible that you might assign a date in the future when the security token or certificate is no longer valid. You should also have the option to enable or disable the twin if you need to blacklist incoming data from a compromised physical entity. Lastly, you bind it to the digital twin model that it’s derived from.

10 Ways to Achieve Internet of Things Success for your Organization

The IoT + IIoT Megatrend is in Danger of Stalling

Many of you who are involved in one of the #IoT segments (industrial, healthcare, consumer, etc.) are currently living in PoC hell. Your pilots, trials and proof of concepts are not making the jump to production for a variety of reasons. I think it’s time to push the reset button on how we convey the value of IoT and how we deliver solutions. The best place to start is by listening to customers.

As it turns out, customers aren’t interested in hearing how smart you are or which esoteric technologies you’re using to build IoT solutions. The only reason they’re talking to you is because they’ve heard Internet of Things solutions can save them money, reduce unplanned downtime/non-productive time, optimize operations, improve worker safety, boost product quality, lower risk and many other compelling value props. Here’s a quick list problems and solutions to get you started:

  1. Customers are finding all the pieces to the IoT puzzle to be too complex. You need to focus on extreme simplicity and reduce friction at every tier of an IoT solution. Hundreds of pages of code examples isn’t working.
  2. Customers don’t have the skill sets needed to work with IoT solutions. Good enough has to be good enough, so stop using technologies and protocols that no one has ever heard of and embrace pervasively adopted tech that everyone already understands. If the tech you’re using isn’t familiar to customers, they’ll be uncomfortable about using your solution.
  3. Customers have heard about large-scale, IoT hack attacks and are reluctant to move forward due to security concerns. Security and privacy must be baked-in to your IoT solution from the get-go and defense in depth must be practiced at every tier of the solution. You must also respect a customers data governance and sovereignty requirements even if it means delivering a 100% air-gapped solution.
  4. Customers struggle to achieve an acceptable return on investment on their IoT solutions. Despite lower costs for all the components required to build an IoT solution, when a customer strings together sensors, microcontrollers, communications networks, storage, middleware, servers, analytics, and integration software, it’s possible that the combined cost could exceed the expected ROI. It’s critically important to beat-up on those costs to stay well-within the ROI envelope.
  5. Customers don’t want another data silo. Too many IoT solutions are focused solely on capturing data from machines and keeping it within their respective systems. It’s important to integrate with a customer’s existing databases, CRM, ERP and other systems no only to add context to machine data but to take actions on insights. Telling a customer they can write code to call APIs on their backend systems is the wrong answer. Make it easy.
  6. Customers keep hearing you must combine Artificial Intelligence with IoT in order to derive value. The tech industry must stop sending this message because it’s dead wrong and it’s scaring customers away. The average person doesn’t know anything about AI except that they think SkyNet is going to take over the planet and robots will be our overlords. There’s tremendous value in connecting your people and machines to gain real-time visibility and situational awareness over your operations. There’s additional value in layering even the simplest analytics to drive decisions and automation. None of this is rocket science and it’s stuff your customers can easily wrap their head around.
  7. Customers who are pitched horizontal IoT platforms quickly become paralyzed. Stop leading with generic, horizontal IoT platforms that try to be all things to all people because it doesn’t work. Customers are not interested in writing code to implement one of many millions of IoT use cases on the platform you’re selling. Your sales motion should include knowing your customer’s business and always leading with vertical solutions to problems they already want to solve.
  8. Customers often find the tech needed to create a smart, connected product eats too much into product profit margins. IoT-enabling products is a super-important way to provide better, ongoing customer service. Especially when those products come with warranties or SLAs that must be met, companies absolutely require IoT capabilities to reduce their risk and eliminate service calls that eat into profits. The sensors, microcontroller, power source, and connectivity for an individual product must always represent the smallest percentage of the total product cost to ensure mainstream adoption. Otherwise, only early adopters will use your smart, connected product.
  9. Customers are unsatisfied with the results they expected from analytics applied to IoT data. This often points to poor data quality and/or unlabeled data. Garbage in, garbage out. Ensure your IoT system is labeling incoming data points as well as mapping unintelligible items like PLC registers to something a human can understand. It’s also super-helpful if your IoT systems knows the data types and units of measure of the incoming data points inside captured data sets to help both simple and advanced analytic systems make sense of the data. Don’t overwhelm customers by delivering 100% of data communicated by endpoints into an IoT system. For the most part, de-duplicate incoming data and only send anomalous data values that stray outside acceptable limits.
  10. Customers have grown tiresome of IoT projects that take too long. I’ve heard of managers who’ve green-lighted IoT projects being asked to leave after 3 years of boiling the ocean to drive value at an organization. Don’t try to boil the ocean anymore. Find small, targeted use cases that can be tackled in just a few months to get tangible, quick wins. When everyone can see the value, move on to the next small project while continuing to build confidence and grow support across the organization. Remember to eat the IoT elephant just one bite at a time.

Keep it simple to achieve success!

Connected World

The Year Ahead in the Industrial IoT

In 2016, we saw breathless growth in the Industrial IoT market with a bewildering mix of solutions confronting the industrial operator.

Head on over to Peggy Smedley’s Connected World where I’ll give you my predictions for the IIoT market in 2017 to help you plan for the new year. Topics I cover include:

  • IoT security moving to the forefront after the DDoS attack
  • Predictive asset heath with machine learning
  • The Internet of Humans and Machines represented by Digital Twins
  • Which IoT platform players will make it and which ones won’t

Don’t miss it!

Hyperspace

Internet of Things Predictions for 2017

When it comes to IoT predictions, 2017 will see solutions solving business pain points jump to hyperspace as VC funding dries up for many platform plays.

As we move into 2017, the marketplace will start to separate the “build it and they will come” crowd from IoT solutions that add compelling business value. When it comes to value creation, I anticipate we’ll finally see technologies that abstract machine learning algorithms plus data prep and cleansing to solve business problems for specific equipment. Think of this as an advanced analytics extension to existing digital twins. Vendors that seize upon this technology will see success in the $900M Industrial IoT market. On the other hand, the vendors promoting generic, often cloud-only platforms that try to be all things to all people will face a tough road ahead.

The IoT platforms set to take off are the ones tailored to specific industries and flexible enough to run on-premises, in hybrid mode and in the cloud as needed by customers. I’m not just talking about cloud offerings that work with edge gateways in the fog. I’m talking about solutions that are truly portable. On the security front, industrial customers will struggle to safely IoT-enable machines that aren’t securable and were never intended to be on the Internet. This will continue to be a problem until next generation versions of industrial equipment rolls off the assembly line with built-in compute, storage, IP networking and security. Expect lots of the industrial world to remain air-gapped and firmly in its M2M comfort zone.

Lastly, enterprises that can merge domain expertise, data science and machine learning will realize cost savings by stretching equipment maintenance cycles and avoiding downtime by predicting asset health. This represents the true value of IoT in business.

Book Cover

Mobile Apps Must be their own Fortress to Withstand Attacks from Hackers

A #mobile app must be its own fortress and never assume platforms are encrypted, authenticated, use VPN or require a PIN for #security.

I guess developers can’t count on anything these days. How you deal with security is what separates consumer app developers from enterprise app developers. The best apps assume an insecure, unencrypted and completely compromised mobile platform. In a world of bring your own app (BYOA), this will differentiate consumer app developers from trusted enterprise app developers. Imagine the scenario where a logged-in device is left behind in a taxi and is stolen before device security kicks-in to log the device out. A window of time ranging from five to fifteen minutes of exposure is realistic.

So how does a mobile app take charge of its own security? On launch, it must prompt for enterprise credentials like a password, PIN, face or fingerprint before allowing a user inside the app. Eliminate the use of cached credentials and tokens or keep expiration times to a minimum. Next, the app must provide its own encryption for data at rest. This is accomplished through the use of a mobile platform’s crypto APIs. Oftentimes you can reuse login credentials as a password and salt value. Use this to encrypt all downloaded and user-entered data before saving to local storage. The app must use TLS or per-app VPN tunnels for all remote communication to secure data in transit. Lastly, trustworthy apps should never take dependencies on platform capabilities they don’t actually require.

Reduce risk to your business by insisting every enterprise app you build or buy provides its own comprehensive security capabilities. Is your company making app security a top priority?

Learn how to digitally transform your company in my newest book, “Mobile Strategies for Business: 50 Actionable Insights to Digitally Transform your Business.”

Book Cover

Click here to purchase a copy of my book today and start transforming your business!

Book Cover

Delivering Apps to Mobile Devices via Remote Pixel Projection is a Terrible Idea

The use of remote pixel projection technology to view Win32 apps on #mobile devices should be considered nothing more than an interim workaround.

What’s the fastest way to move Win32 desktop apps to mobile devices? Don’t feel bad if you chose a remote desktop or screen sharing technology to project PC desktops to smartphones or tablets. This happened decades earlier when companies migrated from 3270 terminal emulation to PC apps. Lots of screen scraping took place to avoid large rewrites.

If you’ve tried various remote desktop technologies on smartphones, you found yourself doing a lot of pinching, zooming, panning and scrolling to accomplish simple tasks. The intermittent nature of wireless data networks results in a frustrating experience. A lack of offline capabilities leads to application errors and possible data loss. Nonexistent integration with essential smartphone sensors leaves employees without the contextual experiences they expect. Obviously, tablets fare much better due to larger screen sizes that more closely match the desktops they’re trying to render. When paired with corporate Wi-Fi, this delivers the least-bad remote experience. The tablet + Wi-Fi scenario is the best compromise for large apps that are difficult to migrate or third-party apps that are out of your control. In limited scenarios where sensitive corporate data is not allowed on a device, remote desktop technologies keep your device free of data. For everything else, remote pixel projection should be a short pause on the road to complete mobile migration.

Reduce risk to your business by using remote pixel technologies in situations where sensitive data cannot be securely moved to a mobile device. Is your company taking a pass on employee productivity by not migrating legacy desktop applications to mobile apps?

Learn how to digitally transform your company in my newest book, “Mobile Strategies for Business: 50 Actionable Insights to Digitally Transform your Business.”

Book Cover

Click here to purchase a copy of my book today and start transforming your business!

Book Cover

It’s Time to Dump your 1990s App Authentication

Migrate Win32 applications secured by client/server #database logins to #mobile apps that use OAuth & enterprise #cloud directories for authentication instead.

Do you know Scott Tiger? Are you familiar with SA and no password? If so, you probably worked with client/server database security mechanisms from companies like Oracle, Microsoft, IBM and others. Anyone who’s built client/server, multi-tier database systems over the years has worked with Oracle Net Listener, TNSNames, Sybase DBLIB, ISAM and VSAM drivers plus a revolving door of Microsoft drivers. App logins were typically the same as the database login. DBAs were in control and app developers worked with what they were given. Sometimes data access was secured through the use of views or stored procedures. Things improved when databases started supporting integrated authentication where data access could be controlled by users and groups found in the company Active Directory.

Today’s mobile apps don’t connect to client/server databases this way. Win32 apps connecting via the LAN or VPN can kick the can down the road a bit longer. Everything else talks to databases with web APIs or sync. While these mobile-friendly APIs use database authentication to connect, the services they expose must be secured by an enterprise directory. This pattern provides identity management to mobile apps. Furthermore, cloud-based enterprise directories must be kept in sync with existing on-premises directories to keep the login procedures seamless for employees. Add multi-factor authentication to boost security and avoid consumer auth providers like Facebook or Twitter.

Reduce risk to your organization by decoupling app security from database authentication and make the move to company-wide directory services. Has your employer switched all its enterprise apps to modern authentication methods yet?

Learn how to digitally transform your company in my newest book, “Mobile Strategies for Business: 50 Actionable Insights to Digitally Transform your Business.”

Book Cover

Click here to purchase a copy of my book today and start transforming your business!