- [Instructor] Smart devices, or embedded devices,
require special security attention,
whether they're found in the home or business environment.
The single most important thing that you can do
to securely use smart devices in any environment
is ensure that they receive regular security updates.
Updating the software that drives these embedded devices
is just as important, if not more important,
as updating the operating system
on your traditional computers.
Hackers regularly discover vulnerabilities
in embedded devices,
and failing to patch them regularly
can result in a serious risk of compromise,
not only of your smart device, but of your entire network.
If you don't realize the significance of these attacks,
consider a string of baby monitor hacking incidents
that took place in 2013 and 2014.
The monitors, manufactured by a company called Foscam,
had a known vulnerability that allowed hackers
to take remote control of the device.
The parents in this story didn't receive the notice
that an update was available,
and awoke in the middle of the night
to hear a hacker screaming, "Wake up baby!"
at their ten-month old daughter.
This attack could easily have been avoided
if the parents knew about the available software update
and had applied it to their baby monitor.
The process for updating different devices
varies significantly.
Some devices have simple automatic update mechanisms
that allow the device to download and install updates
without user intervention whenever they're available.
Other devices lack this automated feature
and require that users check a website for updates
and download and apply them manually.
The bottom line is that you must understand
the update requirements for all of the smart devices
in your home and business computing environments
and follow them carefully.
In very sensitive environments,
such as industrial control systems,
you should go a step farther and institute
a formal firmware version control system
that ensures that the appropriate firmware versions
are installed on all of your system components.
Updates to that firmware should only happen
under the auspices of a formal change management process
that evaluates risk and manages the roll-out process.
In some cases, it's not possible
to patch known vulnerabilities.
Organizations that must run vulnerable systems
may turn to security wrappers as an alternative approach.
In this approach, the device is not
directly accessible over the network,
but instead is reached through a wrapper system
that monitors input and output for security issues
and only passes through
vetted requests from network systems.
You can think of the wrapper
as a sort of mini-firewall for the embedded device.
Whatever approach you choose,
you should incorporate security,
control, diversity, and redundancy.
Taking a layered approach to security
and using multiple controls to achieve the same objectives
improves the odds that your network
will remain safe from embedded device attacks.