Internet of Things
IBM, Siemens and the Charter of Trust
A
Paul Heney, Editorial Director
At last month’s Siemens cybersecurity press meetings, journalists had the opportunity to get the perspective of researchers at IBM Watson’s Munich IoT operations center. The Center brings together developers, consultants, researchers and designers to drive state-of-the-art collaborative innovation with SMEs and start-ups, as well as governments, schools and universities and investors. Dr. Angelika Steinaker, CTO Identity & Access Management, IBM Security Europe, discussed the importance of identity and access management. According to Steinaker, “everything in security is related to identity” and this is of critical importance to everyone involved in cybersecurity. “If you talk about network segregation, and point security, CM, targets, everything is related to identity,” she stressed. She gave the example of a smart bulb located in a building. Whose bulb is it? Who can access it online to control it? While this seems innocuous enough, think of all of the stakeholders involved. Maybe one company owns the building. Another one has leased that building and its employees are working there. A third company is the facility manager. And yet another provides applications for building insights. So, let’s say that the building is equipped with an application to get insights on energy consumption, which has reduced costs considerably. Everyone’s happy. Until the leasing company’s CISO detects that someone has hacked their database through a smart bulb in a conference room. This brings to light (no pun intended) multiple questions — ones that aren’t necessarily so easy to answer:
74
January 2019 www.designworldonline.com
Internet of Things_1-19_Vs3.LL.indd 74
• Who is the owner of security? • How could this situation have happened? • Did the bulb have a Digital Identity? • How could it have been prevented? • How are stakeholders to be supported? Steinaker referenced the famous Peter Steiner New Yorker cartoon from 1993 that featured the caption, “On the internet, nobody knows you are a dog.” She said that today, she might instead caption it, “On the internet, nobody knows you are a bulb.” According to Steinaker, the principles in the Charter of Trust initiative can help to determine the owner and answer these questions. She said that the Watson IoT center in Munich is working with partner companies like Siemens to plan out best practices to avoid these sorts of scenarios. In her estimation, the first step a company should take is to establish Identity Assurance Requirements for device
DESIGN WORLD
1/15/19 10:38 AM