- [Instructor] One way that you can ensure control diversity
and redundancy for embedded systems is placing them
within a secure network environment that is designed
to protect smart devices from attack and protect other
systems on the network from compromised smart devices.
The tried and true way to protect suspect systems
is the use of a control known as network segmentation.
Network segmentation simply places untrusted devices
on a network of their own, where they have no access
to trusted systems.
In the context of embedded devices,
network segmentation might look something like this.
We have our standard corporate wired and wireless networks
that have laptops, desktops and servers connected to them,
and then a separate network, hanging off the firewall,
that contains embedded devices used to control
an industrial process.
Does this look similar to anything you've already seen
in your study of information security?
If it looks like a firewall DMZ,
there's a good reason for that.
It's the same concept.
Placing embedded systems in an isolated DMZ
allows them to access each other and the internet
but also allows you to strictly control that access
as well as limit the access those devices have
to other systems on your network.
Network segmentation is perhaps the most important control
that you can put in place to protect embedded systems.
Application firewalls also play an important role
in protecting your embedded systems,
particularly if those systems are accessible
by untrusted individuals.
Embedded systems that have web interfaces
are susceptible to many of the same web application attacks
that we find on more complex systems.
They can be vulnerable to SQL injection,
buffer overflows, and cross-eyed scripting attacks.
Application firewalls, when placed in front of
embedded systems, monitor inbound traffic
for signs of malicious activity.
And, when they detect this type of hostile traffic,
they can block it before it reaches a potentially vulnerable
embedded device.
These elements are all part of a layered defense.
One final note, the Security Plus exam
also requires that you know how to secure mainframe systems
that are connected to enterprise networks.
Well, mainframes are few and far between these days,
you may still encounter one in some legacy environments.
The good news is that you can treat them
like an embedded device from a security perspective.
The same controls that we've discussed here
for smart devices also work for relatively dumb ones,
like old mainframes.