PANEL TOPIC: ISSUES SURROUNDING INTERNET OF THINGS (IOT) SECURITY UPGRADIBILITY AND PATCHING
No ratings
Presented at First 2017 by
As Director of Standards and Technology Policy at McAfee, Kent is extremely active in the NIST Cybersecurity Framework, participating/presenting in workshops, global outreach, coordinating Intel’s and McAfee’s responses. He co-authored The Cybersecurity Framework in Action: An Intel Use Case and the IETF’s RFC 7203, An Incident Object Description Exchange Format (IODEF) Extension for Structured Cybersecurity Information. He is Chair of the Information Sharing and Analysis Organization (ISAO) Standard Organization’s, Information Sharing Working Group. Previously Kent was the chief McAfee Labs Vulnerability Group Architect and a designated Principal Architect. A founding and current member of the CVE (Common Vulnerabilities and Exposures) Board, an OVAL Board member and active in Security Content Automation Protocol (SCAP), he holds patents in DNS, Email and software patch distribution. Dr. Allan Friedman is Director of Cybersecurity Initiatives at the National Telecommunications and Information Administration in the US Department of Commerce. He coordinates NTIA’s multistakeholder processes on cybersecurity, including initiatives on IoT security upgradability and vulnerability disclosure. Prior to joining the Federal government, Dr. Friedman spent over a decade as a noted cybersecurity and technology policy researcher at Harvard’s Computer Science department, the Brookings Institution, and George Washington University’s Engineering School. He has a degree in Computer Science from Swarthmore College, a PhD in Public Policy from Harvard University, and is the coauthor of Cybersecurity and Cyberwar: What Everyone Needs to Know (Oxford University Press, 2014). John Banghart is Venable's Senior Director for Technology Risk Management, with over two decades of federal government and private-sector experience in risk management, government policy, standards and regulatory compliance, and incident management. He currently co-chairs the NTIA Working Group on IoT Barriers and Incentives. As Director of Federal Cybersecurity at the White House National Security Council, he successfully led efforts to address significant and high-profile cybersecurity issues within major government programs and institutions while facing complex legal, technical, and political circumstances. Previously he led security vulnerability and automation research at the National Institute of Standards and Technology, was Senior Director of Trusted Engineering for Azure at Microsoft, and Director of Benchmark Development at the Center for Internet Security. Vic Chung is a Product Security Architect with SAP Global Security. Vic is responsible for case-management of vulnerabilities reported by hackers and is the lead in Americas. Prior to joining the security team, Vic managed intellectual property compliance for development teams globally and has deep expertise in technical program management. Vic has a Master’s degree in Information Systems from University of Toronto, Canada and a MBA in Technology Management from Open University Business School, UK. Given the rise of IoT, consumers are now playing an important role in cyber-attacks and defense. Our IoT infrastructure security (or lack thereof) can be instrumental in assisting or defeating efforts to protect consumers. This panel consists of industry practitioners, policy advocates, and security researchers discussing the effect of consumer IoT on incident response and security. The ultimate objective is to foster an ecosystem offering more devices and systems that support security upgrades while increasing consumer awareness and understanding. One idea is to enable a thriving market differentiator for patchable IoT with common definitions for manufacturers and solution providers. Shared visions for security upgradability are needed so consumers know what they are purchasing. No such commonly accepted set of definitions or vision exists. Manufacturers struggle to effectively communicate to consumers the security features of their devices. This panel will explore and map out the many dimensions of security upgradability and patching for the relevant systems and applications. Definitions that are easily understandable, while being backed by technical specifications and organizational practices will be discussed. The panelists hope to share these definitions and ideas throughout the broader IoT development and incident response communities, and ultimately with consumers.