information security | BringYourOwnIT.com

The Journey to a Secure Internet of Things Starts Here

January 15, 2016 3 Comments

As the Internet of Things finds its way into ever more critical environments – from cars, to airlines to hospitals – the potentially life-threatening cyber security implications must be addressed. Over the past few months, real world examples have emerged showing how proprietary connected systems relying on outdated notions of ‘security-by-obscurity’ can in fact be reverse engineered and chip firmware modified to give hackers complete remote control. The consequences could be deadly.

A new approach is needed to secure connected devices, which is exactly what the prpl Foundation is proposing in its new document: Security Guidance for Critical Areas of Embedded Computing. It lays out a vision for a new hardware-led approach based on open source and interoperable standards. At its core is a secure boot enabled by a “root of trust” anchored in the silicon, and hardware-based virtualization to restrict lateral movement.

Read more of this post

Filed under IoT Security Tagged with ARM, Cesare Garlati, exploit, information security, infosec, Internet of Things, IoT, IoT Security, jeep hack, MIPS, pentest, threat, trustonic, virtualization, vulnerability

Securing The Internet of (broken) Things: A Matter of Life and Death

October 6, 2015 1 Comment

If you’re like me you’ll probably be getting desensitized by now to the ever-lengthening list of data breach headlines which have saturated the news for the past 24 months or more. Targeted attacks, Advanced Persistent Threats and the like usually end up in the capture of sensitive IP, customer information or trade secrets. The result? Economic damage, board level sackings and a heap of bad publicity for the breached organization. But that’s usually where it ends.

Read more of this post

Filed under IoT Security, Top Posts Tagged with ARM, attack, audit, black hat, Cesare Garlati, cpu, exploit, hacker, hypervisor, information security, Internet of Things, kernel, linux, memory, micro kernel, MIPS, open source, pentest, reverse engineering, root of trust, secure boot, Security, soc, virtualization, virus, vulnerability, white hat

The Data Breach Pandemic: Information Security is Broken

June 8, 2015 Leave a comment

Have enterprises basically just given up on IT security? Global budgets fell by 4% in 2014 over the previous year and as a percentage of total IT budget they’ve remained at 4% or less for the past five years. The picture is even starker for firms with revenues of less than $100m, who claim to have reduced security budgets 20% since 2013.

Yet the threats keep on escalating. When it comes to information security, there are really only two situations out there: companies that have been breached, and companies that still don’t know it.

If 2014 was the “Year of the Data Breach” then 2015 is proving to be at least its equal. This month alone we’ve seen TV stations shunted off air by pro-jihadi cyber terrorists; the discovery of major new state-backed attack groups; and another massive data breach at a US healthcare provider.

We talk today about managing risk, rather than providing 100% security – because there’s no such thing. The conclusion I have reached is that the traditional information security model is broken. But why? And how can we fix it?

Read more of this post

Filed under Information Security, Top Posts Tagged with attack, Cesare Garlati, CSIO, CSO, cybercriminals, cybersecurity, cyberterrorists, data breach, exploit, information security, infosec, pwc, Report, statistics, verizon, vulnerability

Google Vault Makes Play for Mobile Security Hardware Space

June 2, 2015 Leave a comment

Google Project Vault Last week Google made a splash with its latest futuristic tech offering: Project Vault. In essence, this mini-computer on an SD card is designed to enable secure authentication, communications and data storage on your smartphone or laptop. So what exactly is going on here? After years experimenting with Android, has one of the world’s biggest software companies finally admitted hardware level security is the way forward? And if so, what are the implications for enterprise and consumers? Read more of this post

Filed under Mobile Security Tagged with BYOD, Cesare Garlati, CUPP Computing, data protection, Google Vault, information security, Mobile Security, Privacy, Project Vault, prpl Foundation, Vault

Cesare Garlati Joins prpl Foundation as Chief Security Strategist

April 7, 2015 Leave a comment

SANTA CLARA, CA–(Marketwired – April 07, 2015) – Well-known information security expert Cesare Garlati today joins the prpl Foundation as Chief Security Strategist. Garlati will assist the Foundation with security strategy in the newly formed Security PEG (prpl Engineering Group), a working group dedicated to creating an open standard framework that addresses next-generation security requirements for connected devices.

“Cesare Garlati is an internationally renowned leader in the mobile security space,” said prpl Foundation president Art Swift. “We all look forward to his contributions in security strategy and his participation in the ground-breaking Security PEG.”

Read more of this post

Filed under IoT Security Tagged with ARM, Cesare Garlati, Chief Security Strategist, connected devices, information security, Internet of Things, IoT, MIPS, Mobile Security, prpl Foundation

The GitHub attack – is the worst still to come?

April 6, 2015 1 Comment

What we can learn from the recent cyber attack to the popular website GitHub and why we should worry about what is likely to come next.

Over the last few days the popular website GitHub has been the target of a massive Distributed Denial Of Service attack – DDoS, apparently originated from China. As I write this note, the GitHub status webpage now indicates “Everything operating normally” and “All systems reporting at 100%”. However, I am afraid the story is far from over and the worst may still be to come.

GitHub is the largest and most popular repository of open source projects and a key infrastructure website for the Internet. Among other, GitHub hosts the Linux project – arguably the world’s most widespread open source software. Various flavors of Linux power most of the Internet servers and an ever-increasing number of consumer devices across the globe.

Read more of this post

Filed under Information Security, Top Posts Tagged with attack vector, Cesare Garlati, cia, cryptography, cyber warfare, data breach, DDoS, denial of service, DoS, encryption, fbi, Git, GitHub, Great Firewall of China, information security, infosec, Internet security, man in the middle attack, man on the side attack, Mobile Devices, nsa, open source, OpenSSL, POODLE, RSA, software repository, SSL, targeted attack, TTL, vulnerability

About Cesare Garlati

This is my personal blog about disruptive technology trends such as cyber security, open source processors, and the Internet of Things. It's full of my reasoned opinions, some of which will turn out to be absolutely wrong. You should not rely on anything in this blog for any reason other than for amusement.

This blog occasionally quotes excerpts from other publications, in which case it is done under Fair Use. I despise copyright trolls and think the EFF is due for sainthood any day now.

I am the founder of Hex Five Security and an active member of the RISC-V Foundation: some of my writing will appear here too if it's relevant. The opinions here are mine and mine alone, and are not representative of any professional organizations I belong to.

Comments are unmoderated. Say what's on your mind, be direct, speak the truth, etc., I'll try to keep all your comments ...

Happy reading!

BringYourOwnIT.com

The Journey to a Secure Internet of Things Starts Here

Securing The Internet of (broken) Things: A Matter of Life and Death

The Data Breach Pandemic: Information Security is Broken

Google Vault Makes Play for Mobile Security Hardware Space

Cesare Garlati Joins prpl Foundation as Chief Security Strategist

The GitHub attack – is the worst still to come?

What we can learn from the recent cyber attack to the popular website GitHub and why we should worry about what is likely to come next.

About Cesare Garlati

Twitter @CesareGarlati

Recent Posts