IoT Product Lifecycle Part 2

00:00

Hi, I'm Matthew Clark and this is lesson 1.4 I o t. Product Security Part two.

00:08

In this lesson, we will continue to look at the i o T product lifecycle. Specifically, we will learn about the people involved with I o. T. Product security

00:18

within organizations and will set some based on roles for the purposes of this class.

00:24

We will also investigate the product design process and discuss identity and secure operation.

00:30

We will introduce the I. O. T security frameworks and finished with the discussion of I. O. T. Security Economics. So let's get started.

00:40

So let's talk about the people that are involved.

00:42

Every company is different titles and different roles.

00:45

What is called a certain role in one company is going to vary to the next company.

00:51

So for the purposes of this class, let's just take a moment and identify some common roles, and we will list out their responsibilities that we're assuming that this role would have just again just for the purpose of this class. So, product engineer, When we talk about these, we're assuming that these are the people who developed the product that do the

01:11

the work Thean work. Maybe they're in engineering organization,

01:14

our new product development organization,

01:18

product manager. This is the person that would position the product. Maybe they would approve what features go into it or help set price points.

01:26

Product marketing. These are the people that market the product,

01:30

Um, does have a management structure along with stakeholders, and these would be shareholders or board of directors.

01:36

And, of course, there's customers, regulators and security professionals.

01:41

And we're going to talk about how to set up a product security program what resource is a required and how that product security compares to enterprise security all of that in module to.

01:53

So this image is generic product development process image. And I wanted to show this to you early in the course so you could kind of see how the course will be laid out in the information that we're gonna bring into it.

02:07

And so, basically, Ohms used the design process in order to bring an i o t. Product idea from a proof of concept through engineering, design and manufacturing, prototype

02:22

and implementing pilots and eventually move into a mass production. Of course, the design process isn't linear. It's more intuitive, meaning that the result is achieved by repeating the design cycles.

02:34

As a probably security leader, you need to understand the fundamental security concepts that are required to secure and i o t device in the ecosystem that it resides in.

02:44

So hopefully this course will help you see that it's really, really easy to say all that I o T device should be secure. It's a lot harder to actually think about it and figure out all the different steps um, that you need to do. At least it's harder to do that unless you have a framework and a strategy which we're going to go through.

03:05

So it's critical that the OH am ensures that there's a proper plan in place to provide device security from production through operation and eventual decommission.

03:15

This means working with product engineers early in the design process.

03:20

Provisioning of production could be done by either the O. E. M or a contract manufacturer.

03:25

Either way, ah process has to be developed to securely inject identity into the device while keeping secret safe,

03:34

secure shipping operation concerns itself with starting the device in a secure manner, operating it in a secure manner and providing patches and other security updates throughout the lifetime of the device

03:49

frameworks play a key role in device security

03:52

frameworks helped achieve secure by design principles.

03:54

And we're gonna identify various frameworks and use them to illustrate how secure by design principles should be integrated into an I. O. T. Device product security program.

04:05

And these include the O WASP Top 10 for I O. T. The I O T. Security Foundation framework and various ISO and this standards.

04:15

Although we will introduce several frameworks, we will most heavily rely on the I. O T. Security Foundation framework.

04:23

Now a framework is important because it gives product security program structure. It gives the hardware and software engineers clear understanding of requirements.

04:31

It helps identify and re mediate vulnerabilities in the device design before the devices ever created are sold,

04:40

and it helps communicate security in a way that is actionable.

04:46

Lastly, security certainly has an impact on cost both the cost to build the product as well as the cost to support it.

04:53

It's important to realize that consumers have a unique perspective on I o T. Security. They're just simply not willing to pay extra for it.

05:01

They're going to purchase the lowest cost product with the appropriate number of stars and the most positive reviews.

05:10

And it's because of this behavior that the industry really hasn't self corrected. At least not in the consumer device industry,

05:17

where security is more mandated, such as health care or financial or military industries. Security is being more conscientiously built in. For the most part,

05:29

therefore, evidence suggests that regulations and laws or what's driving, changes that we're seeing, and we'll talk more about that amount. Seven.

05:36

But regulators, air starting t demand a certain based security be built into products.

05:42

And we're seeing this in the new laws, such as the California and Oregon i o T. Laws,

05:46

where the term reasonable security is being legislated.

05:50

And no, um, they're starting to react to this downward pressure by implementing products security programs.

05:57

Well, that's it for this lesson.

05:59

Yeah,

06:00

this is a graphic of how the last two lessons fit together

06:03

in this lesson. We discussed the people involved, including product engineers and managers. We discussed the product design process. We discussed identity and some of the concerns of secure operation.

06:15

We introduced a few I ot security frameworks. Specifically,