Ted Harrington

Organized by security consulting and research firm Independent Security Evaluators (ISE), the ISE IoT Village will deliver thought leadership advocating for security advancements in Internet of Things devices. The village will consist of workshops on hacking numerous off-the-shelf devices including medical devices, home appliances, routers, and storage devices; live educational talks; and a variety of contests.

Electronic locking mechanisms introduce new attack vectors as compared to mechanical locks, but if properly designed, there are no inherent flaws with systems that have such attack surfaces. Furthermore, hardened electronic locking systems introduce significant security upgrades over more traditionally deployed mechanical locks. However, the entire premise of security advantages in electronic locks is based on the condition that such a system has had security properly built in, as validated by… Show more

Electronic locking mechanisms introduce new attack vectors as compared to mechanical locks, but if properly designed, there are no inherent flaws with systems that have such attack surfaces. Furthermore, hardened electronic locking systems introduce significant security upgrades over more traditionally deployed mechanical locks. However, the entire premise of security advantages in electronic locks is based on the condition that such a system has had security properly built in, as validated by design assessment, implementation assessment and security assessment. This paper analyzes the various security implications associated with deciding between mechanical and electronic locks for use in access control of physical premises. Show less

For progressive enterprises, security has evolved from an IT issue to a central business issue, as most companies today are re- sponsible for protecting some form of digital asset, such as credit cards, customer data, business strategy, and intellectual prop- erty. As with all business concerns, cost management is of primary importance. With security however, the true cost does not lie in a typical budget line item expenditure; rather it stems from asset compromise (whose costs range from… Show more

For progressive enterprises, security has evolved from an IT issue to a central business issue, as most companies today are re- sponsible for protecting some form of digital asset, such as credit cards, customer data, business strategy, and intellectual prop- erty. As with all business concerns, cost management is of primary importance. With security however, the true cost does not lie in a typical budget line item expenditure; rather it stems from asset compromise (whose costs range from litigation, to fines, to lost revenue, to incident response). Proper hardening techniques are much smaller expenditures in relation to breach re- sponse costs, and are effective in dramatically reducing likelihood of a successful attack.

The challenge for many companies is to understand which hardening efforts are most effective. Studies1 show that as many as 89% of CIOs express confidence in the effectiveness of their security practices, yet those practices often fail to account for evolved, modern adversaries. The black market2 for stolen digital assets has matured, and sophisticated adversaries with finan- cial motivations are incentivized to attack large companies who possess high value digital assets. Even when these adversaries are unsuccessful, incident response costs are significant – but when they are successful, the resulting damages skyrocket to stag- gering and potentially crippling heights.

Contained herein is an analysis of the different cost drivers as well as discussion of approaches to minimize exposure. Show less

To improve the security posture of digital systems, progressive organizations engage third party security experts to as-sess risk and provide hardening guidance. The most suitable approach for most industries is white box vulnerability assessment. However, confusion about different security approaches has led IT executives to commonly request the notably ineffective approach of black box penetration testing. Most executives may be surprised to discover that this approach actually undermines… Show more

To improve the security posture of digital systems, progressive organizations engage third party security experts to as-sess risk and provide hardening guidance. The most suitable approach for most industries is white box vulnerability assessment. However, confusion about different security approaches has led IT executives to commonly request the notably ineffective approach of black box penetration testing. Most executives may be surprised to discover that this approach actually undermines the very risk assessment objectives they seek to achieve. This article will analyze the trend, contrast different tests and methodologies, and outline best practices. Show less