Hardware Podcasts

Best Practices for IoT Security | Optiv Security's Sean Tufts

IoT For All Podcast · 12 Apr 2021 · 29m

What this episode covers

Sean Tufts, Practice Director for OT/IoT at Optiv, discusses the critical importance of visibility and security in IoT deployments, noting that many organizations lack awareness of the devices on their networks. He highlights the risks of cheap, unvetted hardware, citing examples of spyware in retail TVs and breached smart dolls, and emphasizes that security must be integrated into digital transformation rather than treated as an afterthought. Tufts explains how the pandemic accelerated remote access vulnerabilities, leading to incidents like SolarWinds, and advises companies to engage marketing and sales leaders to justify security budgets by aligning them with business goals.

Most relevant to

large enterprises

Topics

Mentioned

Companies
Optiv, Palo Alto, CrowdStrike, McAfee, AWS, Azure, Google, General Electric, Baker Hughes, SolarWinds, FireEye, Microsoft
Products
Alexa
Also
NERC

Related episodes from other shows

Other shows on the same ground, closest first.

  • Embedded.fm · 1h 13m

    192: Button Connected To Nothing

    Terry Dunlap, founder and CEO of Tactical Network Solutions, discusses the critical lack of security in Internet of Things (IoT) devices, citing the Mirai botnet, the TrendNet FTC lawsuit, and the St. Jude Medical defibrillator alert as key examples of failure. He explains that common vulnerabilities stem from insecure coding practices, such as buffer overflows and hardcoded keys, often exacerbated by outsourcing firmware development without source code visibility. Dunlap highlights the emergence of standards like UL 2900 and the work of organizations like CableLabs to enforce firmware evaluation, while noting that consumers often remain vulnerable due to poor router configurations and a lack of firmware update support. He advises manufacturers to implement secure coding practices, use source code auditing tools, and encrypt firmware images to reduce the attack surface before devices reach the field.

    Security & privacyEmbedded firmware
    11 chapters

  • Over the Air · 31m

    Breaking IoT Connectivity Barriers with Chris Baird, CEO of OptConnect

    Chris Baird, CEO of OptConnect, discusses the evolution of IoT connectivity from early copper lines and Wi-Fi to modern cellular solutions for unattended devices like vending machines and kiosks. He details OptConnect's strategic pivot to private networks following the Heartbleed vulnerability and their current focus on 'Max Aware,' a hardware platform that enables edge instrumentation and anomaly detection for customers deploying at scale. Baird also highlights the growing IoT ecosystem in Utah, citing companies like Traeger and Monit as examples of successful connected product innovation.

    Connected products & IoTScaling production
    8 chapters

  • Embedded.fm · 1h 10m

    515: Script Boomers

    Nick Kartsioukas, a Senior Security Engineer, discusses the evolving landscape of embedded system security, emphasizing the critical importance of Software Bill of Materials (SBOMs) and monitoring the Common Vulnerabilities and Exposures (CVE) database. He explains how to secure IoT devices through mutual TLS authentication and hardware roots of trust, while warning against the risks of using complex platforms like the Raspberry Pi in constrained environments. The conversation also covers threat modeling strategies, the crossover between safety and security, and practical advice for engineers to improve their security posture through Capture The Flag (CTF) challenges.

    Security & privacyConnected products & IoT
    8 chapters

  • The Hardware Entrepreneur · 43m

    #017 - How *not* to think about IoT, with Michael Vladimer of Orange IoT Studio, USA

    Michael Vladimer, co-founder of Orange IoT Studio, outlines a framework for building successful IoT products, arguing that they must solve compelling problems rather than just connecting everything. He defines the core MVP of an IoT device as consisting of sensors, connectivity, computation, and user interface, while warning against expecting users to invest smartphone-level effort into these devices. Vladimer also discusses the nuances of IoT security, advocating for context-specific standards based on data sensitivity, and shares insights on cross-cultural communication and storytelling in product development.

    Connected products & IoTSecurity & privacy
    7 chapters

  • Coredump Sessions · 1h 03m

    #000: How New IoT Security Regulations Will Shape the Industry's Future

    François Baldassari, founder and CEO of Memfault, and co-founder/CTO Chris Coleman discuss the impact of new IoT security regulations, specifically the EU's Cyber Resilience Act (CRA) and the US FCC's Cyber Trust Mark. They argue that OTA updates, Software Bill of Materials (SBOM) tracking, and device observability are now mandatory for compliance, moving security from an afterthought to a core engineering requirement. The hosts highlight that ignoring these regulations risks severe liability, citing recent pager explosions and Shimano bike shacker hacks as examples of physical dangers from insecure connected devices.

    Security & privacyEmbedded firmware
    9 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by IoT For All Podcast. The episode itself belongs to its publisher.