Cisco Blogs


Cisco Blog > Security

Security Realities of IoT (Internet of Things)

January 23, 2014 at 9:00 am PST

Are you a security professional or IT professional just resolving the security issues with BYOD (bring-your-own-device)? Watch out, BYOD was a precursor or warm up exercise to the tsunami just hitting your shores now.

The SANS Institute just completed a survey on the security viewpoints on IoT, predominantly with security and IT professionals.

78% of respondents were unsure of the capabilities for basic visibility and management of Things they will need to secure or lack the capability to secure them.

It seems that, like BYOD, IoT is driven with minimal IT consultation. And it happens with security as an afterthought, with 46% who do not have a policy to drive the visibility and management of IoT devices.

The top security controls used today for securing IoT were 68% authentication/authorization, 65% system monitoring, and 49% segmentation. That translates into Cisco Secure Access solutions that offer superior visibility, robust intelligent platform of critical context, and highly effective unified secure access control. More importantly, this will also help the 74% that rely on manual processes for discovery and inventory of connected device (from previous SANS research).

Over half (67%) are using SIEM (security information and event management) to monitor and collect data to secure IoT. Cisco ISE (Identity Services Engine) integrates with SIEM to bring together a network-wide view of security events supplemented with relevant identity and device context. This provides security analysts the context they need to quickly assess the significance of security events. More details on the ISE and SIEM integration may be found in this new white paper: Cisco ISE Plus SIEM and Threat Defense: Strengthen Security with Context

The research rightfully points out that, of the many categories of Things, the newest category of single-purpose devices typically connected by wireless (and more likely embedded) software will be the most problematic for security. Due to this difficulty, the SANS community (61%) would like the Thing manufacturers to take more responsibility for providing security. While this is a reasonable request, the question is whether they have the expertise to do this when their focus is on the exciting new IoT market opportunities. Weigh in and tell us your outlook on securing this next wave of Things connecting to your network!

The paper on the SANS survey results is in the SANS reading room.

Tags: , , , , , , , ,

2014: More Secure Access, Please

January 9, 2014 at 1:30 pm PST

Are you back from holiday break all refreshed and ready to embrace 2014 with confidence?

Many organizations will see new devices on their networks given the recent massive holiday gift giving. In particular, educational organizations will be morst likely to be impacted. It seems there was no new hot toy (must-have gift) noted this year because kids want electronics. A recent survey indicated that 88% of kids ages 12 to 17 said that they most wanted a gadget as a holiday gift, with the majority (69%) requesting some kind of Apple device.

Students are returning to school with their shiny new electronic mobile devices and no hesitation to access the resources at school. Educational institutions continue to strive to enable users, while minimizing potential risk, and security continues to be the top concern.

Secure AccessConsider this:

Secure Mobility in Higher Education

Secure Mobility in K-12 Education

The challenge of secure mobility will persist as the device storm continues. 2014 opens with the Consumer Electronics Show in Las Vegas, January 7-10. The last couple years the show highlighted latest smart phones and tablets. It seems this year a heavy focus on the Internet of Things—with sensor-based devices that feed information to a computer over the Internet, further emphasizing the Any to Any problem, which changes the security paradigm. Any user on any device increasingly going over any type of connection, to any application, that could be running in any data center and on any cloud. Regardless of how or where our users are connecting, we have to provide the right levels of inspection and protection against malicious intruders who may steal sensitive data or disrupt business. Let’s start to think and be prepared for what organizations may see coming on their networks and what the security implications may be for next year.

Happy 2014!

Tags: , , , ,

Honesty is the Best BYOD Policy

Does BYOD really mean that my device will become the company’s device? Do I control my private data or does my employer? How can I make sure I maintain a work-life balance when my personal device is also my work device? Will my company support any device I choose?

Some of these questions might seem familiar as more business employees consider adding their own device to their company’s network. These questions also represent an important part of a comprehensive mobile strategy: User buy-in.

Brett Belding BYOD - without headerRecently, I read an interesting CIO article by Adam Bender that highlighted the importance of getting employees on board when implementing a BYOD policy. The article discusses that according to Frost & Sullivan analyst, Audrey William, many employees are worried that they won’t be able to control data on their device once they begin using it for work. In addition, William states that employees are also concerned about the lines blurring between work and play when both personas are merged onto one single device.

Although the concept of BYOD is not new, these concerns have important consequences in our networked world. So, what’s the answer?

An honest, safe, and secure MDM solution and effective policy communication. Read More »

Tags: , , , , , , , , , , , , , ,

Robot Soccer? Staying Connected at Bowdoin College

October 15, 2013 at 2:14 pm PST

As our team has prepared for Educause 2013 this week, we have been talking a lot about technology in higher education and how it’s impacting colleges, universities, students and staff. Of course, robot soccer was not the first thing that came to mind, but it’s a great example of how different technologies are changing education forever.

Bowdoin College, which you may remember from last year’s #1 Most Connected College, is one of my favorite case studies because it points out that people have to TRUST technology for it to really be effective. Trust is a big word, really – I know I’m not the only person who is a little gun shy when I think about updating my phone to a new software version. So, when a professor has a class full of students and says “let’s all stream this video right now”, it’s important that it actually works – or professors risk losing student attention, losing time and facing maximum frustration levels.

Read More »

Tags: , , , , , , , , , , ,

A Financial Service Organization Speaks Out on Secure Access

October 14, 2013 at 9:41 am PST

Are your finances secure with your financial institution? Vystar Credit Union in Florida, USA speaks out on one of their recent efforts to ensure highly secure access at their institution. With the pressures of compliance and the need to protect their institution’s network and assets, Vystar deploys ISE and AnyConnect with great success. Most recently coming from Gartner IT conference in FLA I had a chance to speak with other organizations that expressed secure access concerns. Read More »

Tags: , , , , , ,