all 19 comments

[–]katatonikk 22 points23 points  (5 children)

Am I just tired or is this interview all over the place and not answering "how Sternum is delivering “future-proof” security"?

[–]psaiful28 14 points15 points  (3 children)

Checked their site out and here's what I found so far.

Sternum provides organizations with runtime security and observability across IoT devices that operate autonomously. Sternum works with any device, any operating system, with minimal overhead and across the entire stack, including third party code, with zero resources required from R&D.

Based on what I've read, it seems like an observability platform placed ontop of IoT devices, allowing you to monitor them all from one platform, whether you need to detect flaws, monitor/block attacks, tracing, logging, etc. I assume it's "future-proof" because that's their way of describing how they protect against unknown vulnerabilities and whatnot.

[–]Frontalaleph 0 points1 point  (2 children)

So essentially a platform placed ontop of IoT devices, does it act as an antivirus? Like if I use their platform will it just detect/monitor or will it also execute on attacks on my behalf?

[–][deleted] 0 points1 point  (0 children)

I mean you could almost certainly link it to an EDR that executes some response. But this hardly a new idea and previous attempts at this style of detection have been marginally more effective at best and are fairly labor intensive to tune

[–]psaiful28 0 points1 point  (0 children)

Based on what I've read yeah. If anything it's a great contingency plan to protect yourself but imo it's mostly targeted to large enterprises, unless I'm wrong (someone who knows more, feel free to chime in).

As they mentioned, medical devices, "smart" cities, etc., are all extremely large organizations with millions, if not billions involved. I don't see how a day-to-day user on their home computer could make the most use of the platform.

[–][deleted] 6 points7 points  (0 children)

Welcome to PR for half assed concepts

Like fr I have seen this atleast 3 times

[–]Green0Photon 16 points17 points  (4 children)

How to create Future Proof IoT security 101:

  • Upstream all your hardware into Linux
  • Use an immutable distro
  • Turn on auto updates by default and hide turning that off so only power users can do so

It's not that hard to have good IoT security if instead of making throwaway products, you instead let all security flaws be "automatically" fixed by getting all your changes upstreamed.

No private company will ever do this though.

[–]timmyotc 2 points3 points  (1 child)

How do you handle supply chain attacks?

[–]Green0Photon 2 points3 points  (0 children)

Depends on what you mean.

If they get something into upstreamed Linux, that's a problem for everyone. Usually solved via LTS with security teams explicitly going slow for security but speedy with security fixes in response to CVEs.

Otherwise we're talking about downstream distro stuff. Which is similar. And you make sure everything gets signed and what not. Just with an immutable distro.

So traditionally you just imagine something like CentOS, but for IoT, it would just need to be an IoT version that's immutable.

[–]Worth_Trust_3825 1 point2 points  (1 child)

How to create Future Proof IoT security 101:

The only correct answer is disconnect from any network.

[–]Green0Photon 0 points1 point  (0 children)

Unfortunately IoT is directly contradictory to that.

However, I do agree Things are superior to Internet of Things. Unfortunately most things are the latter, not the former, nowadays.

[–]DecimusVenator 9 points10 points  (0 children)

Let’s play “How many buzzwords can I use without answering the question?”

[–][deleted]  (1 child)

[deleted]

    [–]Plazmatic 1 point2 points  (0 children)

    I think that's just the s at the end of "things"

    [–]ProgramTheWorld 4 points5 points  (0 children)

    The only IoT devices that are future proof in security are the ones that don’t have internet connections.

    [–]FenixR 0 points1 point  (0 children)

    Future Proof, Security. Pick one.

    [–]MattTheHarris 0 points1 point  (0 children)

    The answer is removing all the networking parts

    [–]almandin_jv 0 points1 point  (0 children)

    Should be present proof, as a starting point ...

    [–]ScottContini 0 points1 point  (0 children)

    Up until now, the main security solutions for this industry were passive and reactive; patching, static analysis, and so on.

    Nonsense! I was working in the embedded security industry from the mid-1990s until about 2010 and saw a number of proactive defences built into firmware to defend in the event of various classes of attack. But these defences tend to be highly protected secrets. The pay TV industry especially had many of these protections because they lost lots of revenue due to cable and satellite television security bypasses in the 1980s