IoT Product Security
Course Content
This course, taught from the perspective of a CISO or a senior director in either a security or engineering organization, will focus on the information required to design and implement an IoT product security program. The topics discussed in this course will apply to any Information Security Program trying to understand how to securely handle IoT, IIoT, ICS, and OT technology within the enterprise. By better understanding the underlying security concerns of designing and manufacturing IoT devices, security practitioners can better understand how to secure these devices within their environments.
The IoT security field is maturing and changing at an incredible rate. At the same time, IoT is expanding into our everyday lives and will continue to have an increasing impact on how we live our lives. Threat actors understand this and see the immature industry as an opportunity to do evil.
This class is designed for senior-level security professionals and assumes the learner has knowledge of advanced security concepts, experience leading security or engineering organizations, and is comfortable with business risk and governance concepts. The class is organized in a way to help organizations stand up an IoT product security program; however, any learner with a desire to understand how to apply cyber security principles to IoT security will benefit from the material in this class.
This class takes a deep technical dive into designing and establishing a secure foundation of trust within the IoT device and ecosystem architecture. The class will take a deep technical dive into roots of trust, anchors of trust, secure boot, and managed boot with an in-depth discussion of secure elements and hardware roots of trust, including TEE, TPM, HSM, and DICE. It discusses the steps an organization can take to develop a product security program to address IoT security, including factors of success, reporting structures, and which elements of the existing information security program that can be incorporated and enhanced for product security. This class discusses how an organization can proactively develop tools to address IoT vulnerabilities, such as developing an enterprise vulnerability disclosure program using tools such as bug bounties and responsible disclosure. It discusses hot topics, such as third-party risk, IoT physical and logical security, OTA patching, architecture frameworks, and IoT manufacturing considerations in foreign markets. The class will identify secure IoT device provisioning and manufacturing practices, including a robust examination of security considerations for chip manufacturers, IoT device OEMs, and contract manufacturers. This class also discusses relevant legal and regulatory changes affecting the global IoT market and steps organizations should consider to meet the changing security and privacy environment. Lastly, this class uses real-world case studies and goes behind the news headlines to discuss how organizations can take steps today to prevent becoming tomorrow's next Internet meme.
Prerequisites
This course assumes the learner has a strong foundation of security engineering concepts, security management practices, and business leadership principles and can apply these concepts in a leadership capacity.Course Goals
By the end of this course, students should be able to:Instructed by
I started my career in information security in 1999, when I was hired to help Goodyear prepare for Y2K. I’ve spent most of my career in the manufacturing sector securing the global enterprise, plant ICS and SCADA networks and helping to secure IoT products.
I have over 20 years of experience in Information Technology and have grown with the security industry since 1999, when Y2K came along as the ultimate unfounded FUD (fear, uncertainty, and doubt) event. I have a Master’s Degree in Business (MBA), a Bachelors Degree in Business (BBA), and an Associates Degree in Computer Networking. I have several security certifications, including the Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified in the Governance of Enterprise IT (CGEIT), Certified Data Privacy Solutions Engineer (CDPSE), and ITIL Foundations. I have previously taught classes in IoT security, computer forensics, server security, and family and personal safety on the Internet.
I currently serve on several advisory boards, including EC-Council’s CISO Advisory Board, HMG CIO Executive Leadership Advisory Board, and Evanta’s CISO Governing Body. I’ve also been a member of InfraGard since 2016 and a proud volunteer of the Danville Area Humane Society since 2000. I’ve been in a unique position to see the security industry mature over the last 20+ years and have been blessed to work with some of the finest people in the field.
What I enjoy most about my professional career is that I am in a position to help others. Whether it is combining technical and security knowledge with business acumen to address cyber security risks to critical business processes or simply answering a question about how to protect a coworker’s family online, I honestly love helping people.
I consider myself to be a professional student. I am extremely goal-oriented and love learning and challenging myself. I am always working on my next class, project, or certification.
Over the last several years, I have watched Cybrary grow and mature. It is a unique platform that connects the learner to instructors and other professionals in the security field. They offer over a thousand hands-on learning experiences that add practical skills to academic knowledge. As a hiring manager, I have learned that this mixture practical and academic knowledge is invaluable. I am excited to be associated with Cybrary.
Fun Fact: I once (technically) lived on a cruise ship. We sold our home and cruised two weeks before we closed on another one. In the period between owning homes, our only permanent address happened to floating in the ocean.
