This article describes composition of the IOT. In order to manage risk you need to understand not only the applications, devices, or services under assessment, but also the other types of devices that will at some point certainly share parts of the underlying infrastructure of the IOT.

First and foremost one needs to learn what is meant by “requirements” in a security and engineering context, why requirements are useful for managing risk and what IOT requirements may look like. Risks will manifest themselves in relation to “requirements” or project goals: what do you need to get from the project for it to ...

The proliferation of botnets reveal a worrisome trend in the spread and sophistication of computer viruses and worms in the Internet today. (A botnet is essentially a collection of compromised distributed computers or systems, known as bots because of their zombie-like nature, under the control of a bot-herder, by virtue of the use of command ...

Hash functions are cryptography’s most widely used primitives, in that they are a fundamental building block used for a wide variety of constructions. The recent attacks of Joux, Wang, and others against the current generation of hash functions has stimulated a resurgence of research into these primitives as well as spawned an international competition, sponsored ...

The Internet of Things (IOT) is about small machines in remote locations speaking to big centralized machines, often making decisions and taking action without people in the loop. It represents billions of devices speaking to each other, often managing outcomes in the physical environment. The IOT presents business opportunities in virtually all industrial sectors. The ...

Enhanced Privacy ID (EPID) is a cryptographic scheme that enables the remote authentication of a hardware device while preserving the privacy of the device owner. A hardware device with an EPID private key embedded can prove to a remote party that it is a valid device, certified by the hardware manufacturer, without revealing its identity ...

In this article we go through some basic concepts with the purpose of providing context for the discussions in the chapters that follow. Here, we review briefly the concept of the cloud as defined by the U.S. National Institute of Standards and Technology, and the familiar terms of IaaS, PaaS, and SaaS under the SPI ...

A signifi cant development in the malware landscape in recent years is the ability of hackers to monetize compromised platforms by (1) gathering valuable information that can be sold, (2) using the platform’s resources to aid in an illicit or unwanted activity, or (3) holding information contained on the platform for ransom. Since the attacker’s ...

When it comes to data on-premise or in the cloud…security is the number one concern for IT. Who better to address the benefits of hardware root of trust than Intel’s own Senior Security Engineer. James Greene discusses why hardware integrity checking is an important component of security in the cloud and how Intel TXT is ...