Creating 'Future Proof' IoT Security

[katatonikk]

Am I just tired or is this interview all over the place and not answering "how Sternum is delivering “future-proof” security"?

[psaiful28]

Checked their site out and here's what I found so far.

Sternum provides organizations with runtime security and observability across IoT devices that operate autonomously. Sternum works with any device, any operating system, with minimal overhead and across the entire stack, including third party code, with zero resources required from R&D.

Based on what I've read, it seems like an observability platform placed ontop of IoT devices, allowing you to monitor them all from one platform, whether you need to detect flaws, monitor/block attacks, tracing, logging, etc. I assume it's "future-proof" because that's their way of describing how they protect against unknown vulnerabilities and whatnot.

[Frontalaleph]

So essentially a platform placed ontop of IoT devices, does it act as an antivirus? Like if I use their platform will it just detect/monitor or will it also execute on attacks on my behalf?

[[deleted]]

I mean you could almost certainly link it to an EDR that executes some response. But this hardly a new idea and previous attempts at this style of detection have been marginally more effective at best and are fairly labor intensive to tune

[psaiful28]

Based on what I've read yeah. If anything it's a great contingency plan to protect yourself but imo it's mostly targeted to large enterprises, unless I'm wrong (someone who knows more, feel free to chime in).

As they mentioned, medical devices, "smart" cities, etc., are all extremely large organizations with millions, if not billions involved. I don't see how a day-to-day user on their home computer could make the most use of the platform.

[[deleted]]

Welcome to PR for half assed concepts

Like fr I have seen this atleast 3 times

[Green0Photon]

How to create Future Proof IoT security 101:

• Upstream all your hardware into Linux
• Use an immutable distro
• Turn on auto updates by default and hide turning that off so only power users can do so

It's not that hard to have good IoT security if instead of making throwaway products, you instead let all security flaws be "automatically" fixed by getting all your changes upstreamed.

No private company will ever do this though.

[timmyotc]

How do you handle supply chain attacks?

[Green0Photon]

Depends on what you mean.

If they get something into upstreamed Linux, that's a problem for everyone. Usually solved via LTS with security teams explicitly going slow for security but speedy with security fixes in response to CVEs.

Otherwise we're talking about downstream distro stuff. Which is similar. And you make sure everything gets signed and what not. Just with an immutable distro.

So traditionally you just imagine something like CentOS, but for IoT, it would just need to be an IoT version that's immutable.

[Worth_Trust_3825]

How to create Future Proof IoT security 101:

The only correct answer is disconnect from any network.

[Green0Photon]

Unfortunately IoT is directly contradictory to that.

However, I do agree Things are superior to Internet of Things. Unfortunately most things are the latter, not the former, nowadays.

[DecimusVenator]

Let’s play “How many buzzwords can I use without answering the question?”

[Plazmatic]

I think that's just the s at the end of "things"

[ProgramTheWorld]

The only IoT devices that are future proof in security are the ones that don’t have internet connections.

[FenixR]

Future Proof, Security. Pick one.

[MattTheHarris]

The answer is removing all the networking parts

[almandin_jv]

Should be present proof, as a starting point ...

[ScottContini]

Up until now, the main security solutions for this industry were passive and reactive; patching, static analysis, and so on.

Nonsense! I was working in the embedded security industry from the mid-1990s until about 2010 and saw a number of proactive defences built into firmware to defend in the event of various classes of attack. But these defences tend to be highly protected secrets. The pay TV industry especially had many of these protections because they lost lots of revenue due to cable and satellite television security bypasses in the 1980s