41:02This recording is not available yet.
Categories
Identity & AccessOT, IoT & Critical InfrastructureIoT & Connected DevicesNetwork Security & Zero TrustZero Trust
Vendors and tools discussed
Sponsored by
About this session
Jeff Carpenter of ForgeRock argues that IoT devices, which outnumbered employees in most organisations years ago, should be managed as a third identity type alongside workforce and consumers. After defining an IoT device (a small processor with storage and connectivity that must authenticate to a gateway) and extending the idea to robotic process automation, such as an insurer's one-day claim payout, he presents six principles. First, adopt an identity mindset: onboard, entitle, adjust and decommission devices through a lifecycle, with a named business owner, the way you would a new hire. Second, security: passwords are not enough, so prefer certificate-capable devices, centralised certificate policy and rotation, and gateways to reach set-and-forget hardware. Third, market maturity: analysts still place IoT in the innovation phase, platform vendors provide inventories, and IAM vendors handle the lifecycle. Fourth, a one-identity approach that ties things to people so decisions on scaling and retirement have an owner. Fifth and sixth, optimisation and transformation: fleet and pacemaker telemetry, constrained-network policies, valve-as-a-service and connected-car services such as a teen-driver module that turn secured devices into revenue.
Congratulations on your new Identity! Along with your consumer and workforce users, you now
have another identity to welcome to the family. I’m sure you have big plans for it...or do you? While you may have thought of your IoT as just a bunch of edge or
infrastructure devices, not managing these “things” as full-fledged identities of your organization may mean missed opportunities and lost revenue. In this session, you’ll learn: Why is too much emphasis being placed on securing these
devices and not enough on how they can serve the strategic interests of your organization? What are the best practices of managing IoT as identities? The benefits of tying together relationships between your device and human. Join ForgeRock’s Jeff Carpenter, CISSP, CCSP, in this informative and somewhat entertaining discussion of all things Internet of Things.
Key takeaways
- Run every device through an identity lifecycle: proof and onboard it, grant birthright entitlements, adjust privileges over time and decommission it with the business owner's sign-off.
- Buy IoT devices that can accept certificates, then manage those certificates by central policy, with short expirations (as little as six months) for devices in critical roles and automated rotation.
- Plan for set-and-forget hardware: many devices cannot answer status queries, so route them through a gateway or proxy that applies policy and reports state.
- Secure robotic process automation with the same rigour as devices; an RPA flow that pays claims is a target in its own right.
- Define how a device must behave when network-constrained or offline, since fleets, rigs and factories rarely have reliable connectivity.
Speakers
Jeffrey Carpenter
Jeff is passionate about securing identities of all types – human and machine. He is a seasoned professional with broad experience in access control, cryptography, biometrics, virtualization, cloud, mobile and network security. Having spent much of… Read moreRead less
Jeff is passionate about securing identities of all types – human and machine. He is a seasoned professional with broad experience in access control, cryptography, biometrics, virtualization, cloud, mobile and network security. Having spent much of his career in cyber security and identity, he has worked for leading companies in this space including RSA and HID Global. He finds his true calling bringing new and innovative solutions to market that ultimately enable us to interact and do more online. Jeff holds both CISSP and CCSP certifications.
