Welcome!

@ThingsExpo Authors: Pat Romanski, Elizabeth White, Yeshim Deniz, Liz McMillan, Zakia Bouachraoui

Blog Feed Post

Virtual Patches for IoT: Now more than ever

When Gunnar Peterson and I wrote about the security considerations for Internet of Things, one of the key items was patching ("Vulnerabilities will be found in IOT systems, but how will they be patched? IOT systems require management systems for patching and versioning"). The problem is that Internet of Things devices are often difficult to update. There isn’t an equivalent of a “Patch Tuesday” for a wristband, or a Wi-Fi-enabled smart meter. Many devices do not have an auto-update mechanism, or may be constrained by bandwidth or processing power. Rather than patching the device itself, patches will often have to be applied upstream as “virtual patches”. A Gateway is the ideal point to apply these virtual patches.

Heartbleed made this device all the more important. This week, in an article entitled "It’s Crazy What Can Be Hacked Thanks to Heartbleed", Robert McMillan covers the work of Nicholas Weaver at UC Berkeley. Weaver has been investigating the vulnerability of devices such as programmable thermostats, home routers, and (ironically) home firewalls to Heartbleed. The problem is that many of these devices are difficult to patch.

He writes "The bad news is that many of the devices that can be hacked can only be updated manually", and "In other words, the Internet of Things needs a patch".

Virtual patches are the key here. They allow patches to be applied upstream from the Internet-of-Things device itself, applying a "wrapper" layer. Virtual patches are also something I also discussed in BBC articles in the context of vulnerabilities in power station control systems and in protecting Windows XP systems now that patches are no longer provided by Microsoft.

By enabling virtual patches to be applied, security gateways are an important piece of a mitigation strategy for vulnerabilities such as Heartbleed. They are the upstream point at which you can apply security mitigation, when devices themselves may be difficult or impossible to patch. This is why at Axway, we provide gateways for Web Services and API traffic, gateways for B2B and file-transfer, and Gateways for email and file sharing. Heartbleed will not be the last vulnerability to impact the Internet of Things in this way, but by applying a virtual patching strategy at the Gateway layer, security mitigation is possible.

Read the original blog entry...

More Stories By Mark O'Neill

Mark O'Neill is VP Innovation at Axway - API and Identity. Previously he was CTO and co-founder at Vordel, which was acquired by Axway. A regular speaker at industry conferences and a contributor to SOA World Magazine and Cloud Computing Journal, Mark holds a degree in mathematics and psychology from Trinity College Dublin and graduate qualifications in neural network programming from Oxford University.

IoT & Smart Cities Stories
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true ...
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
We are seeing a major migration of enterprises applications to the cloud. As cloud and business use of real time applications accelerate, legacy networks are no longer able to architecturally support cloud adoption and deliver the performance and security required by highly distributed enterprises. These outdated solutions have become more costly and complicated to implement, install, manage, and maintain.SD-WAN offers unlimited capabilities for accessing the benefits of the cloud and Internet. ...
In an era of historic innovation fueled by unprecedented access to data and technology, the low cost and risk of entering new markets has leveled the playing field for business. Today, any ambitious innovator can easily introduce a new application or product that can reinvent business models and transform the client experience. In their Day 2 Keynote at 19th Cloud Expo, Mercer Rowe, IBM Vice President of Strategic Alliances, and Raejeanne Skillern, Intel Vice President of Data Center Group and G...
Business professionals no longer wonder if they'll migrate to the cloud; it's now a matter of when. The cloud environment has proved to be a major force in transitioning to an agile business model that enables quick decisions and fast implementation that solidify customer relationships. And when the cloud is combined with the power of cognitive computing, it drives innovation and transformation that achieves astounding competitive advantage.
DXWorldEXPO LLC announced today that "IoT Now" was named media sponsor of CloudEXPO | DXWorldEXPO 2018 New York, which will take place on November 11-13, 2018 in New York City, NY. IoT Now explores the evolving opportunities and challenges facing CSPs, and it passes on some lessons learned from those who have taken the first steps in next-gen IoT services.
The current age of digital transformation means that IT organizations must adapt their toolset to cover all digital experiences, beyond just the end users’. Today’s businesses can no longer focus solely on the digital interactions they manage with employees or customers; they must now contend with non-traditional factors. Whether it's the power of brand to make or break a company, the need to monitor across all locations 24/7, or the ability to proactively resolve issues, companies must adapt to...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
Founded in 2000, Chetu Inc. is a global provider of customized software development solutions and IT staff augmentation services for software technology providers. By providing clients with unparalleled niche technology expertise and industry experience, Chetu has become the premiere long-term, back-end software development partner for start-ups, SMBs, and Fortune 500 companies. Chetu is headquartered in Plantation, Florida, with thirteen offices throughout the U.S. and abroad.
René Bostic is the Technical VP of the IBM Cloud Unit in North America. Enjoying her career with IBM during the modern millennial technological era, she is an expert in cloud computing, DevOps and emerging cloud technologies such as Blockchain. Her strengths and core competencies include a proven record of accomplishments in consensus building at all levels to assess, plan, and implement enterprise and cloud computing solutions. René is a member of the Society of Women Engineers (SWE) and a m...