IoT is changing the world as we know it, bringing new opportunities and innovation to almost every industry. We’ve seen this first hand at Ordr, where our customers in healthcare, manufacturing, retail and government are reaping the benefits and efficiencies of IoT.

Whatever the business outcome — from patient diagnostics to inventory management to building access – there is a sensor, system or device that delivers on that promise. The real challenge is ensuring the visibility and security of all these devices. With more than 25 billion IoT devices deployed in 2020, and 75 billion expected in 2025, the downside of playing fast and loose with IoT security can be devastating. As Zeus Kerravala, Principal Analyst at Zeus Research, said, “Every connected device is a potential attack vector, especially when deployed outside the purview of security and IT. In order to secure their devices, organizations must start with visibility into what is actually connected but most organizations don’t have the time or resources to do this manually, and have had to live with the risk of not knowing what’s lurking in the shadows.”

This is why we launched our new IoT Discovery Program – to shine a spotlight on what’s previously been in the shadows. The IoT Discovery Program includes a complete kit – Ordr Core and zero touch provisioning sensor– to discover and classify IoT (and shadow IoT) devices in the enterprise. The IoT Discovery Program is so simple and seamless, it removes resource or project barriers that prevent organizations from truly understanding what is in their network

We’re especially proud to have the IoT Discovery Program available through Ordr channel partners, including Cadre, Carousel Industries, GuidePoint Security, Logicalis, Novacoast, and The Teneo Group. We’ve been working with these strategic partners and their enterprise customers in early deployments of Ordr Core and the IoT Discovery program since the beginning of the year.

The feedback from the program has been overwhelmingly positive, and we hope you’ll give it a try. Our partners are standing by, ready to help you get started today.

• “I am a security researcher focused on all kinds of malware and I was surprised it found all of these issues quickly and the details are amazing” – Mike L., Software Company
• “Pretty amazed with what Ordr collects and the details of what it collects” – Ron B, Financial Services
• “Easy to use, plug and play, I got a lot of info quick.” – Chris L., Security Company

Greg Murphy

Greg joined Ordr as CEO in December 2018. Previously, he was VP Business Operations for the HPE Aruba Group, the 4,000 person networking and IoT business unit of Hewlett Packard Enterprise. In that role, Greg was responsible for leading the business integration of Aruba and HP Networking following HP’s $3 billion acquisition of Aruba Networks in 2015. Greg held multiple prior senior executive positions within Aruba, including SVP Business Operations, GM of network management software, GM of outdoor and mesh products and VP of Marketing. Greg joined Aruba in 2008 through its acquisition of AirWave Wireless, a network management software provider that Greg founded and led. Greg received his M.A. from Stanford University and his B.A. from Amherst College.

Segmentation Done Right – Part 3 of 3

Segmentation is a good thing and we understand the benefits and we also know that segmentation needs to be done right. Doing it right means segmenting in a non-rigid manner and having a clear goal in mind before VLANs are deployed randomly or likeminded devices are just lumped together. In our concluding series, we discuss our take on flexible segmentation and how to generate policies using the observed behaviors of devices.

At Ordr we can granularly group devices by type or even group the same type of devices across an enterprise. For example, if you want to see all your cameras across your entire enterprise we can do that. Want to see cameras only used by the surveillance security department? Or cameras just in the manufacturing line? We can slice it or dice it any way you like in ways that fit your business requirements.

One popular starting point that we see with some customers is segmentation by vulnerabilities. This process entails segmenting by the most vulnerable devices in your network. For example, think about all the cameras that come with a default password which is oftentimes just “password”. We can help segment these vulnerable cameras from the rest of the network to reduce their attack surface if they get hacked. Later on, we can help a hospital segment another group of precious devices such as CT scanners and patient monitoring devices which are often vulnerable since they run older operating systems. Older operating systems can be an issue since they can be susceptible to malware attacks, oftentimes inadvertently introduced by a healthcare worker who worked remotely, visited a bad site, and then came back to the hospital.

With the Ordr system, you can work through the device population one group at a time, based on your specific business criticality requirements. This is a very granular configurable method vs the traditional way of segmenting …the all or nothing approach of traditional VLANs. Think of it rather as a personal VLAN per device. We can help security personnel maintain good network hygiene by segmenting rogue access points, preventing devices from guest networks accessing clinical resources, and even help identify and remove outlier devices from incorrect segments.

With our approach, there is no need to declare a zero-trust day plan, and then execute to that milestone only to realize that the business requirements have changed, the device population has increased, or the network footprint evolved. With Ordr, you can start the segmentation journey now with a logical device-centric approach vs. big rigid boxes of categories. Our micro-segmentation approach is easier to execute, flexible and changes as your business requirements change, equipment is moved around due to utilization adjustments, or whatever the case may be.

We add insights into understanding the behaviors of devices. Once Ordr has baselined all the traffic, the system can report any time a device attempts to communicate outside its defined network behavior. This will be alerted on the main dashboard and as a device security incident. We can further show you the flows of traffic per device and how it interacts with every other device in your network. We can tell you what’s “normal” as we have intelligently mapped and baselined the traffic. Our system can subsequently report any time a device attempts to communicate outside its defined network behavior. This deviation from a device’s normal behavior will be alerted on the main dashboard as a device security incident.

At Ordr, you can group and segment however you prefer, the choice is yours. Whether it is creating network segments for medical vs. facilities vs. a contractor vs. the emergency room, even subsegment the pharmacy if you like. And within each segment, you can selectively allow access by various groups. With granular flexible micro-segmentation from Ordr, you can contain any potential breaches and damage. Whitelist internal flows for your business needs flexibly. Blacklist with micro-segmentation, we do that too. We give you the tools to do segmentation right and we give you the smarts to take control.

Read Segmentation Done Right – Part 1: Great Idea and Segmentation Done Right – Part 2: Seeking A Better Way.

Pandian Gnanaprakasam

Pandian has more than 20 years of product and engineering leadership experience and is also a serial entrepreneur. Before founding Ordr, he was the Chief Development Officer at Aruba, responsible for all of engineering and product management functions. Aruba, an enterprise mobile wireless company, was acquired by HPE for $3 Billion in March 2015. Before Aruba, Pandian served as the head of engineering for Cisco’s multi-billion-dollar Wi-Fi business unit and before that as VP of engineering for low-end switching product lines. He graduated with a master’s degree in Electrical Engineering from IIT, Chennai, India and holds several patents to his credit in various networking technologies.

Watching Part 2 of the Minnesota HIMSS webinar series Medical Device Security Overview for Healthcare Delivery Organizations with speakers Matt Dimino and Carrie Whysall from CynergisTek, I found the following to be useful information that you can apply to your organization’s security program development.

IoT & IoMT Device Security

Device Risk

The biggest medical device security risk organizations face is the possibility of a widespread attack or multiple security threats happening at once. This can cause widespread unavailability of devices needed to treat patients. The integrity of devices is also important to consider, without proper device management and supervision, malware can remain undetected.

Gaps

Medical devices should be assessed at point of purchase. Before putting a device on a network it should be checked for basic passwords and other vulnerabilities. Organizations should also know all devices that are on the clinical network, and track what those devices are doing. Clinical Engineering (CE) and Information Technology (IT) teams should work together to leverage their training and awareness of device security risks.

Challenges

Typically there are safety specialists who focus on technical controls and separate specialists who work on risk management, but these tasks should be joined into one security plan so that medical devices are controlled and monitored for risks.

Difficulties Developing a Medical Device Security Program

Developing a medical device security program can be difficult for a multitude of reasons:

• Business: Lack of adequate funding, staffing and training issues, as well organizational structure impede the creation of a joint CE and IT security program.
• Policy and Procedure: Organizations’ IT policies and procedures rarely include medical device security, and have disjointed governance and sponsorship policies.
• Technical: Typical IT network tools do not work for medical device security purposes, and without passively scanning them as part of the IT network, medical devices often get overlooked. Use of legacy devices also causes technical issues, as devices are not updated for long periods of time.
• Vendors: Medical device vendors utilize different remote access controls that may or may not be able to show who/what causes devices to crash.
• Physical Security: Physical guest access to devices and the potential for organization IDs to be used to gain access to devices puts them at risk.

Addressing the Stakeholders

Involve all parties in the creation of a medical device security plan. Make clinical staff aware of the integrity of medical devices such as ultrasounds and anesthesia machines. Also include CISOs, IT teams, Healthcare Technology Management (HTM) teams and vendors. Discuss with all those involved the objectives of creating a medical device security plan and set up a timeline, as creating and rolling out a security plan can take many months.

How Ordr Can Help

Creating a device security program is challenging on its own, and would be even more difficult without a product to help passively scan for devices and identify risks.

The Ordr System Control Engine (SCE) gives organizations the power to enable visibility and security of their network-connected devices, with a simple and powerful solution to identify, classify, profile the behavior and risk and automate action for every network-connected device in the enterprise. Want to experience Ordr on your network? Request a free sensor.

In the past few years, the United States has made more moves against technology companies that are based in China or backed by the Chinese government. To name a few:

• Hikvision – IoT cameras
• Dahua – IoT cameras
• iFlytek – voice recognition software
• Megvii – image recognition and deep-learning software
• SenseTime – facial, text, and image recognition, object detection, medical image analysis, and more
• Yitu Technologies – facial and speech recognition, natural language processing, and more
• And attempts to ban Huawei – telecommunications equipment

In late 2019, in response to the discovery of backdoors that facilitated communication between cameras made in China and destinations inside China, the U.S. government amended the National Defense Authorization Act to prohibit the U.S. government from purchasing and installing Chinese-made surveillance cameras. Other governments around the world followed suit.

Along with the NDAA amendments, the government advised that all federal agencies would have to remove the devices by August 13, 2019. At last check, there were still thousands of the devices in service. Once deployed, it seems, the cameras have been difficult to account for—despite a Department of Homeland Security mandate that federal agencies be able to track every device attached to their networks.

“There are all kinds of shadowy licensing agreements that prevent us from knowing the true scope of China’s foothold in this market,” The Freedonia Group’s Peter Kusnic told Bloomberg News. “I’m not sure it will even be possible to ever fully identify all of these cameras, let alone remove them. The sheer number is insurmountable.”

Depending on who you ask, by 2025 there will be between 41.6 billion and 83 billion IoT devices deployed to networks worldwide. A vast majority of these devices were created for ease-of-use by consumers, rather than with security in mind. Yes, both can exist in an ideal world, but for IoT devices, it is very uncommon. These devices often have obsolete or unsupported operating systems, unpatched vulnerabilities, and a lack of proper communication protocols.

As we know from the experience of the federal government, once deployed it can be difficult to find these devices making it nearly impossible to remove them if needed. Organizations are continuing the plight to ensure all connected devices are accounted for and the U.S. government is now attempting to do that through a number of directives from the National Institute of Standards and Technology (NIST) designed to ensure secure deployment, management, and operation of all network connected devices. These include standards like the NIST Cybersecurity Framework (CSF) and the Federal Information Processing Standard (FIPS) 140-2, requiring validated cryptography for device communications.

But, as the U.S. federal government’s experience with Chinese surveillance cameras illustrates the issue of unmanaged devices – one that every organization must grapple with. How do you find and secure the devices that are putting your organization at risk (Mirai, dark_nexus, malware, C2 takeovers, etc.)?

Find out more about how Ordr can help your organization discover and classify all network devices, identify high-risk devices (CVEs, FDA recalls, etc.), and give your team the ability to assign policies that protect your enterprise.