My name is Nicole Scheffler and I'm excited to be hosting for Anna as she gets some rest since we're 24 hours. And let's just get right into introducing Mai Wang.Uh She is amazing, Dr May Wang is uh just a very intelligent, amazing woman who's gonna be talking to us today about Secure IOT. She has um she's currently the co-founder of Zing Box doing a lot of bleeding edge work in this area. And um in addition, she spent uh several uh years at Cisco Systems where she had the highest engineering title possible. So I definitely know of her from her work there as I also work at Cisco and I have um heard about her through the engineering circuit uh there. So now she's in a different position. I'll let her tell a little bit about herself, but you guys are in for a joy of a conversation because IOT is more important than ever with the boom of devices. So over to you may

thank you so much for the introduction, Nicole.

Yes, and I could see you and see your slides beautifully. If you wanna go into presentation mode, it will make them a little bigger or at least slide the um slide view over, you know, so we see a little bit more whatever you prefer.

Bo Yes, yes. Thank you. Great. Thank you so much for the great introduction, Nicole. And uh it's really my great pleasure to present here. Welcome to the session about internet things which can mean life or death in real world. My name is May Wang from Palato Networks, a public security company based in Silicon Valley. I was co-founder and CTO of Xin Box, which was recently acquired by Palato Networks. Today, I'll talk about the current status of IOT security, the internet thing security, top IOT threads, the challenges and then end with solutions. Our team has spent the past five years focusing on how to use machine learning to secure IOT devices and enterprises. We have a team of experts with phd S from Stanford Berkeley and MIT conducted in depth research on IOT security. We have been monitoring and securing 15 million IOT devices. So in this presentation, I'm going to share the insights we discovered from both our research and real world deployments. This is a disclaimer from Palato networks. IOT is a very fast growing market every day. There are increasing amount of IOT devices connected onto enterprise networks.

Every single company requires IOT devices to run their business, whether it is video conferencing equipment or security cameras, network attached printers IP phones, IOT represents over 30% of end points we're seeing today, we expect that number to continue growing. The number of IOT devices will surpass the number of it devices in the near future. Also increasing amount of new devices coming out of manufacturing floor into the market are network enabled. For example, in healthcare, more than 40% of newly manufactured medical devices are connected to network doubled from 20% several years ago. The broad usage of IOT devices brings us efficiency. It also represents new cybersecurity risks. Iot security becomes a broad a bo a boardroom discussion now and securing them is very hard. You can't install endpoints agents on most of these devices nor would you want to, you can easily patch them when new vulnerabilities are discovered. And traditional managed device security controls typically don't work very well. So first, let's take a look at where we are today. We recently released the IOT thread report leveraging 1.2 million IOT devices we have sampled and analyzed during the past two years across industries.

I will highlight some insights from this thread report to give you a sense about the current status of IOT security in real world. You're also welcome to download the full report from this website or just Google Palato networks, IOT thread report, we discovered many vulnerabilities among IOT devices.

For example, 98% of IOT traffic is not encrypted. 40 41%. The most common type of attacks in IOT device devices is exploits. And 57% of IOT devices carry severe vulnerabilities. For example, in our research lab, we can hack into an infusion pump and randomly change the dosage of medication going directly into a patient's body that alone means life or death. We found iot security shares similar characteristics and challenges across industries, manufacturing, education, finance, smart city, smart building, smart transportation, retail, utility, et cetera. Today, I will just mainly show data from two sectors as examples, general enterprise and health care.

What kind of IOT devices do we see the most in enterprises? This chart shows the distribution. The top three types are IP phones, printers and intercom systems. They together can account for 71% of all IOT devices but are these the most vulnerable devices in this chart? Blue bars are the same as in the last slide showing device. Distribution red bars show security issues caused by different types of devices. While IP phones account for 44% of all enterprise IOT devices, but only 5% of all security issues. On the other hand, cameras are the most vulnerable ones contributing to one third of security issues even though they make up only 5% of enterprise IOT devices. That was the case in general enterprise. Very similar. We see very similar trends in medical devices. Top three types of devices account for 74% of medical IOT devices. There are infusion pumps, imaging systems and patient monitoring systems and when it comes to security issues, the most vulnerable medical devices are imaging devices. They make up 16% of all medical devices, but account for about half of security issues. We'll discuss the reasons later. The same 8020 rule applies here again, the top three categories of most vulnerable medical devices contribute to majority of security issues. The next question is what kind of attacks we're seeing on these IOT devices? The number one category is exploits including network scans IP scans, poor scans and vulnerability scans on networks attempting to identify flaws in devices and systems to take advantage of.

We're also seeing some new trends, for example, crypto mining in the thread report we released two years ago, we saw zero crypto mining. Now it increases to 5%. We even discovered crypto mining in medical devices. Another trend we're seeing is more additional peer to peer latter movement of these vulnerabilities. This lets hackers minimize connections to the outside world and enables the swamp to operate even without the internet connection. Many sec security issues are caused by IOT devices.

Vulnerabilities, hackers are exploring these vulnerabilities all the time. Many IOT devices are using default user name and passwords. Also obsolute software and operating systems without patches. Here is the example, our data shows that 83% of medical imaging systems currently run on end of life operating systems with known vulnerabilities and no security update or patch support. This is a big jump from last year as a result of windows seven reached its end of life. This past January, we're still seeing windows XP and even windows 98 being used in hospitals. Now, we know there are so many security issues in the real world. Let's take a look at the challenges why it is so hard to protect IOT devices is iot the same as it from years of study on IOT devices? We found unique characteristics of IOT compared to it. We summarize them into five LS. Not only are there a large quantity of IOT devices but also large variety. They can be designed for very different functionalities with different hardware, different software, different operating systems. If they do have operating systems at all, different protocols and different applications in it, we have a relatively homogeneous environment. There are a handful of mainstream opening systems that most it devices use.

But in IOT, it is very heterogeneous, many preparatory systems and protocols, different IOT devices are deployed in different industries used in different ways. It is a very fragmented market. It is hard to have a uniform static preset rule based security solution to protect all different devices.

Many of IOT devices don't have much capability to protect themselves. Lots of them don't even don't have enough computation power memory space nor networking capability. Simpler devices can't have agents downloaded to them, can't do encryption even though their self-protection capability reduces their security risk surface increases.

And the stake is higher if compromised because of the ubiquity of IOT devices and many of them are in critical infrastructure. We change our cell phones and laptops every year or every other year. But IOT devices are often deployed in the field for 10 to 20 years long life cycle creates additional security challenges. The role IOT plays is also multidimensional. In addition to being another end point on the it network, an IOT device also carries operation value, keeping up its normal operation and minimizing downtime are critical requirements. Many IOT devices are also cash cows critical to business. For example, an MRI machines downtime of 15 minutes will cost a hospital $5000. Not only there are technical challenges, but there are also organizational challenges. It used to be, it team was in charge of all the connected devices, security. But now lots of these IOT devices are brought in by different teams, whether that is procurement finance operation facility or even employees themselves. Now who's in charge of IOT security, who's responsible for IOT security. So we see for in order to protect IOT devices, we need a new process for this itot convergence. There are many myths about IOT security. Here are a couple of examples when the IOT device is compromised.

Not only we are concerned about data leakage and data privacy as in it but also operation interruptions because of often weaker security postures of IOT devices, hackers can leverage these low hanging fruits as stepping stones to connect to other devices on the network. Another myth is once we have a secure device, then we're doing well in for iot security. But IOT devices and systems are used in a range of heterogeneous environment which result in different risk profiles. And there are lots of challenges for device vendors to secure these devices, whether they can use the most up to date, secure protocols, encryption and they are often short of resources, whether it's time to market and financial constraints. And mo most importantly, security expertise and needless to mention there are many legacy devices out in the field. So even though IOT devices can be built to the strongest security standards at the time of deployment. But the end of the day, challenges will occur, this could be unforeseen technical challenges, human error or hackers with ever evolving attack methods and these devices are used at in different environment used in different ways and by different users. So that we we need to emphasize not only the device security but when it comes off the manufacturing floor, when it comes off the manufacturing floor, but also iot risks and security in real world deployments.

And many organizations have realized the importance of iot security, but very few knows what to do. From our years of research and real world deployments. We demonstrated artificial intelligence provides very effective solutions to iot security issues. Why? That's the case? One of the biggest challenges in IOT security is scalability. How do you have one solution to protect billions of different devices? But on the other side, because of these IOT devices, they are generating tons of data that we could, couldn't have access before or we couldn't have such real time access before. So this huge amount of data are actually providing us real time insights. And in order to scale up the solution, that's exactly what artificial intelligence is good at to process huge amount of data and to scale up the solution. And another characteristic we mentioned before that IOT is very heterogeneous. There's so many different devices and they all have different characteristics.

But on the other side, we see lots of patterns among with for each type of device because these IOT devices are relatively simpler devices and they are purposely built to conduct specific functionalities. For example X ray machine, it's just supposed to take images, upload images, archive images.

So we do see relatively predictable patterns among these devices. For example, Infusion pump would ping its server every nine minutes and IAP camera would ping its server every five minutes. A video conferencing system would ping its server every 10 minutes. And because it's relatively predictable patterns, a fixed patterns, it's fairly easy for machine learning to pick up these patterns and learn from these patterns and then scale up to billions of devices. And these are exactly advantages. Uh Artificial intelligence can bring to us and every time we talk to a potential customer. The very first challenge they face is visibility. They don't know what devices, how many devices there are in their organization. And a very standard way to do asset management nowadays is once or twice a year, a team of people get on to the floor to manually collect information and make updates on each piece of asset. Obviously, this approach is not scalable and doesn't provide timely updates. What we want to know is at any given time, a comprehensive view of all devices in different groups and different locations within the organization, especially given the dynamic nature of IOT devices, the old static solution doesn't work anymore. So it's very important for IOT security solution to provide visibility and provide real time visibility. And that's also we can leverage machine learning to automatically identify devices on our network.

And the second important thing is we can use, utilize machine learning to automatically build up normal behavior profile and do 24 by seven real time monitoring of these devices behaviors and characteristics so that whenever there's any abnormal behaviors happen, we can easily catch them.

And the third important point for any IOT security solution is to be able to take actions. If you do see a device got compromised, you should be able to send alert and quarantine this device. So here are three key takeaways from this session. First of all IOT security is relevant to everybody and every organization. It is already here today. It is not something in the future. We already start to see many vulnerabilities of these IOT devices and we start seeing attacks to these IOT devices on daily basis. A second takeaway is you do need a integrated solution to leverage your existing network security infrastructure based on our customers. Data. On average, each one of our customer is having 34 security tools in their enterprise. So nobody wants to manage and deal with another tool.

So it's very important to have integrated solution to provide the whole life cycle security for IOT devices all the way from visibility to assessment to enforcement. And the third one is artificial intelligence is a very powerful tool can provide the scalability and ease to use for IOT security because many users who are using these IOT devices do not have the it expertise nor security expertise. So make a tool that's very easy to use for whether that's operational operation team or healthcare, physicians and medical staff. It's very important requirement for IOT security solution.

Great. Thanks. We're a little over time. So I just wanna see if there's anything else, if you wanna say how people can reach out to you. Doctor Mei

Wang. Yeah, this is, this is uh my contact information and uh feel free to email me or look, look me up in, linking to connect. Thank you so much.

Thank you. Thank you so much. We'll have you exit the stage. Let's give her a round of applause. Very great. We have to secure these iot devices so very important uh for companies and for even your personal home to really understand who can get at that. So interesting cameras most vulnerable. Thank you again for that.