techUK: Securing the IoT – Workshop Review

This week saw the techUK host a workshop on securing the Internet of Things and overcoming the risks associated with an increasingly connected world. The event (#IoTSecurity) attracted a variety of speakers from the public and private sector and brought about some interesting topics and further questions on this ever changing landscape.

Embedded Device and Host Device Life Cycle Disparity

Stephen Pattison from ARM, introduced the event, and brought up and interesting view of the challenge with keeping IoT devices up to date - either with firmware, software or hardware improvements.  He observed there is often a disparity between the small inexpensive sensor, actuator, or controller type components and the host device with respect to life span.  For example, a car may last 15 years, whilst a tracking component may last 36 months.  The rip and replace nature of general consumerism has subtle issues with respect to the IoT landscape, where the re-provisioning of new embedded devices, or the improvement in existing devices is often overlooked.

IoT Security Issues versus Opportunities

Duncan Brown, European Security Research Director at IDC, outlined some of the key problems facing the IoT landscape from a security perspective.  The main factors contributing to the security issue, can basically be broken down into the number of physical devices and the amount of data those devices generate.  The sheer volume of connected devices, opens up a new attack vector, with often the network these devices operate on, only being as secure as the weakest link.  That weakest link is often a low powered and poorly protected device, which allows a land and expand pivot style attack, which if successful, can quickly allow attacks on to more powerful computing resources.  The second main factor is associated with the yottabytes (a trillion terabytes !) of data IoT devices related devices are capable of collecting.  That data needs to be protected in transit and also at rest, where transparent access control and sharing protocols need to be applied.  These issues of course, are now opening up new sub-industries, where security assessments, device certifications, software audits and consultancy practices can provide services for.

As with many consumer related interactions, IoT also create an 'elastic security compromise'.  You seemingly can only have 2, out of enjoyable user experience, low risk and low cost.

Indirect Attacks

David Rogers, CEO of Copper Horse Solutions, with his specialism in mobile security, focused on describing how some of the challenges facing the telco operators over the last 10 years, can now be applied to the IoT space. With many newly manufactured cars by 2017 going to contain SIM technology, attack vector, data collecting and data sharing aspects of driving will increase substantially.  David made a subtle observation with respect to how IoT attacks could develop.

Whilst many laugh at the prospect of their digital fridge or washing machine being hacked as a gimmick, the net result of a large scale attack on home automation, isn't necessarily placing the immediate home owner as the victim.  The attacker in this case, could well be targeting the insurance market - which would face a deluge of claims if their washing machine suddenly flooded for example.

Privacy Challenges

Sian John, Security Strategist at Symantec, then focused on the IoT standards and privacy landscape. She argued that IoT is in fact rapidly becoming the 'Internet of Everything', where increased connectivity is being applied to every aspect of everyday life.  Whilst this may delivery better service or convenient experiences, this also opens up new security vulnerabilities and issues with regards to consumer data privacy.  Whilst the IoT ecosystem is clearly focused on physical devices, Sian argued that there is in fact a triad of forces at work: namely people, things and data (albeit I prefer 'people, data and devices...').  Often, the weakest link is the people aspect, who are often concerned with regards to personal data privacy, but don't have the knowledge or understanding with regards to terms of condition, consent questioning or device configuration.

Sian also pointed out that many consumers have a deep distrust of both technology vendors and social network operators when it comes to personal data privacy.

Overall, it seemed the discussions were focused on the need for a strong and varied security ecosystem, that can focus on the entire 'chip to cloud' life cycle of IoT data, where the identity of both the devices and people associated with those devices is strongly managed.

By Simon Moffatt











techUK: Securing the IoT – Workshop Review

This week saw the techUK host a workshop on securing the Internet of Things and overcoming the risks associated with an increasingly connected world. The event (#IoTSecurity) attracted a variety of speakers from the public and private sector and brought about some interesting topics and further questions on this ever changing landscape.

Embedded Device and Host Device Life Cycle Disparity

Stephen Pattison from ARM, introduced the event, and brought up and interesting view of the challenge with keeping IoT devices up to date - either with firmware, software or hardware improvements.  He observed there is often a disparity between the small inexpensive sensor, actuator, or controller type components and the host device with respect to life span.  For example, a car may last 15 years, whilst a tracking component may last 36 months.  The rip and replace nature of general consumerism has subtle issues with respect to the IoT landscape, where the re-provisioning of new embedded devices, or the improvement in existing devices is often overlooked.

IoT Security Issues versus Opportunities

Duncan Brown, European Security Research Director at IDC, outlined some of the key problems facing the IoT landscape from a security perspective.  The main factors contributing to the security issue, can basically be broken down into the number of physical devices and the amount of data those devices generate.  The sheer volume of connected devices, opens up a new attack vector, with often the network these devices operate on, only being as secure as the weakest link.  That weakest link is often a low powered and poorly protected device, which allows a land and expand pivot style attack, which if successful, can quickly allow attacks on to more powerful computing resources.  The second main factor is associated with the yottabytes (a trillion terabytes !) of data IoT devices related devices are capable of collecting.  That data needs to be protected in transit and also at rest, where transparent access control and sharing protocols need to be applied.  These issues of course, are now opening up new sub-industries, where security assessments, device certifications, software audits and consultancy practices can provide services for.

As with many consumer related interactions, IoT also create an 'elastic security compromise'.  You seemingly can only have 2, out of enjoyable user experience, low risk and low cost.

Indirect Attacks

David Rogers, CEO of Copper Horse Solutions, with his specialism in mobile security, focused on describing how some of the challenges facing the telco operators over the last 10 years, can now be applied to the IoT space. With many newly manufactured cars by 2017 going to contain SIM technology, attack vector, data collecting and data sharing aspects of driving will increase substantially.  David made a subtle observation with respect to how IoT attacks could develop.

Whilst many laugh at the prospect of their digital fridge or washing machine being hacked as a gimmick, the net result of a large scale attack on home automation, isn't necessarily placing the immediate home owner as the victim.  The attacker in this case, could well be targeting the insurance market - which would face a deluge of claims if their washing machine suddenly flooded for example.

Privacy Challenges

Sian John, Security Strategist at Symantec, then focused on the IoT standards and privacy landscape. She argued that IoT is in fact rapidly becoming the 'Internet of Everything', where increased connectivity is being applied to every aspect of everyday life.  Whilst this may delivery better service or convenient experiences, this also opens up new security vulnerabilities and issues with regards to consumer data privacy.  Whilst the IoT ecosystem is clearly focused on physical devices, Sian argued that there is in fact a triad of forces at work: namely people, things and data (albeit I prefer 'people, data and devices...').  Often, the weakest link is the people aspect, who are often concerned with regards to personal data privacy, but don't have the knowledge or understanding with regards to terms of condition, consent questioning or device configuration.

Sian also pointed out that many consumers have a deep distrust of both technology vendors and social network operators when it comes to personal data privacy.

Overall, it seemed the discussions were focused on the need for a strong and varied security ecosystem, that can focus on the entire 'chip to cloud' life cycle of IoT data, where the identity of both the devices and people associated with those devices is strongly managed.

By Simon Moffatt











Rencontrez ForgeRock à SIdO Lyon, les 7 et 8 Avril

Salon Internet des ObjetsJe serai présent avec notre équipe au SIdO, l’événement 100% dédié à l’Internet des Objets qui aura lieu à Lyon les 7 et 8 Avril 2015.

Outre notre présence dans l’espace coworking pendant les 2 jours, Lasse Andresen, CTO de ForgeRock, animera un workshop avec ARM et Schneider sur la place de l’Identité dans l’Internet des Objets, le Mercredi 8 à 13h30.

N’hésitez pas à venir nous rendre visite dans l’espace coworking.


Filed under: General, InFrench Tagged: conference, ForgeRock, france, identity, internet-of-things, iot, Lyon, privacy, security

POODLE SSL Bug and OpenDJ

A new security issue hit the streets this week: the Poodle SSL bug. Immediately we’ve received a question on the OpenDJ mailing list on how to remediate from the vulnerability.
While the vulnerability is mostly triggered by the client, it’s also possible to prevent attack by disabling the use of SSLv3 all together on the server side. Beware that disabling SSLv3 might break old legacy client applications.

OpenDJ uses the SSL implementation provided by Java, and by default will allow use of all the TLS protocols supported by the JVM. You can restrict the set of protocols for the Java VM installed on the system using deployment.properties (on the Mac, using the Java Preferences Panel, in the Advanced Mode), or using environment properties at startup (-Ddeployment.security.SSLv3=false). I will let you search through the official Java documentations for the details.

But you can also control the protocols used by OpenDJ itself. If you want to do so, you will need to change settings in several places :

  • the LDAPS Connection Handler, since this is the one dealing with LDAP over SSL/TLS.
  • the LDAP Connection Handler, if the startTLS extended operation is to be used to negotiate SSL/TLS establishment on the LDAP connection.
  • the HTTP Connection Handler, if you have enabled it to activate the RESTful APIs
  • The Crypto Manager, whose settings are used by Replication and possibly the Pass Through Authentication Plugin.
  • The Administration Connector, which is also using LDAPS.

For example, to change the settings in the LDAPS Connection Handler, you would run the following command :

# dsconfig set-connection-handler-prop --handler-name "LDAPS Connection Handler"
--add ssl-protocol:TLSv1 --add ssl-protocol:TLSv1.1 --add ssl-protocol:TLSv1.2
-h localhost -p 4444 -X -D "cn=Directory Manager" -w secret12 -n

Repeat for the LDAP Connection Handler and the HTTP Connection Handler.

For the crypto manager, use the following command:

# dsconfig set-crypto-manager-prop
--add ssl-protocol:TLSv1 --add ssl-protocol:TLSv1.1 --add ssl-protocol:TLSv1.2
-h localhost -p 4444 -X -D "cn=Directory Manager" -w secret12 -n

And for the Administration Connector :

# dsconfig set-administration-connector-prop
--add ssl-protocol:TLSv1 --add ssl-protocol:TLSv1.1 --add ssl-protocol:TLSv1.2
-h localhost -p 4444 -X -D "cn=Directory Manager" -w secret12 -n

All of these changes will take effect immediately, but they will only impact new connections established after the change.


Filed under: Directory Services Tagged: directory, directory-server, ForgeRock, opendj, poodle, security, ssl, vulnerability

New ForgeRock product available : OpenIG 3.0

Since the beginning of the year, I’ve taken an additional responsibility at ForgeRock: Product Management for a new product finally named ForgeRock Open Identity Gateway (built from the OpenIG open source project).

OpenIG is not really a new project, as it’s been an optional module of OpenAM for the last 2 years. But with a new engineering team based in Grenoble, we’ve taken the project on a new trajectory and made a full product out of it.

OpenIGOpenIG 3.0.0 was publicly released on August 11th and announced here and there. But as I was on holidays with the family, I had not written a blog post article about it.

So what is OpenIG and what’s new in the 3.0 release ?

OpenIG is a web and API access management solution that allows you to protect enterprise applications and APIs using open standards such as OAuth 2.0, OpenID Connect and SAMLv2.

Enhanced from the previous version are the Password Capture and Replay and SAMLv2 federation support features. But OpenIG 3.0 also brings several new features:

  • Support for OAuth 2.0 and OpenID Connect standard protocol to ease authentication and authorized access from clients, browsers, mobile devices and things
  • Support for scripting using the Groovy language to quickly develop complex flows
  • Support for protecting multiple applications or APIs with a single instance and splitting configuration in multiple dynamically reloaded files

I’ve presented publicly the new product and features this week through a Webinar. The recording is now available, and so is the deck of slides that I’ve used.

You can download OpenIG 3.0 from ForgeRock.com, or if you would like to preview the enhancements that we’ve already started for the 3.1 release, get a nightly build from ForgeRock.org.

Play with it and let us know how it is working for you, either by email, using a blog post or writing an article on our wiki. I will be reviewing them, relaying and advertising your work. And I’m also preparing a surprise for the authors of the most outstanding use cases !

I’m looking forward to hear from you.


Filed under: Identity, Identity Gateway Tagged: authentication, authorization, ForgeRock, gateway, identity, oauth2, openidconnect, openig, opensource, product, release, samlv2, security

Gartner Security Summit – IoT Review

This week saw the Gartner Security and Risk Management Summit being held in London.  A well attended and respected summit, it brought together the great and good of the infosec world, providing attendees, with a vendor and analyst view of governance, malware, identity and firewall related security topics.



The area that caught my attention though, were the sessions on internet of things related security.

The IoT world is fast becoming the catch all bucket, for any small device that connects to the internet, but isn't a smartphone.  There are some incredibly smart innovations taking place in this space, from consumer and health monitoring, through to operational technology and smart grid and utility monitoring solutions. Tiny fit-for-purpose devices, that perform a small, repeatable task, such as gathering data and sending to a central hub or broker service.  They often have very limited hardware capacity, tiny if-at-all operating systems and very rarely contain out of the box security.

The main focus today, is generally for IoT vendors to promote interoperability - great demo's and show cases, focusing on integration or data transfer under low power or capacity constraints.

Topics such as device registration, claiming and association, data encryption or data sharing, rarely get mentioned or focused upon.

Gartner's Earl Perkins, introduced an intriguingly titled session called "Herding Cats and Securing the Internet of Things".  Earl touched up the need to have a tiered approach to IoT security, covering infrastructure, identity and data.  Whilst the devices themselves are often associated with data capture and replay, it's often the data owners - real people - who could be exposed in a data breach disaster.

Following Earl, was Trent Henry discussing how Public Key Infrastructure, the once expensive and seemingly legacy encryption approach, was having a new lease of life in the machine to machine (M2M) landscape, where username and password authentication is of limited use.  It seems logical, that the use of things like asymmetric keys (perhaps minted at manufacture time) and certificate distribution can become the defacto standard in the M2M game.

The increased popularity of things like NFC (near field communications) has opened the scope for smartphone payment technology, through the implementation of secure elements, within the phone's hardware.  Such secure elements are likely to be seen within other non-phone devices that have a requirement for the storage of credential or certificates and keys.

One of the major issues with the IoT landscape, is often associated with basic identity management, such as how devices register to a service or authoritative source and how the corresponding data owners are able to authorize and share data to trusted third parties.  Whilst the devices themselves could be simple, the data captured, is often of a high value and simple yet robust trust and privacy models need to be implemented.

Many of the newer authorization standards such as OAuth2, OpenID Connect and User Managed Access (UMA) may have a significant role to play here.

By Simon Moffatt


Gartner Security Summit – IoT Review

This week saw the Gartner Security and Risk Management Summit being held in London.  A well attended and respected summit, it brought together the great and good of the infosec world, providing attendees, with a vendor and analyst view of governance, malware, identity and firewall related security topics.



The area that caught my attention though, were the sessions on internet of things related security.

The IoT world is fast becoming the catch all bucket, for any small device that connects to the internet, but isn't a smartphone.  There are some incredibly smart innovations taking place in this space, from consumer and health monitoring, through to operational technology and smart grid and utility monitoring solutions. Tiny fit-for-purpose devices, that perform a small, repeatable task, such as gathering data and sending to a central hub or broker service.  They often have very limited hardware capacity, tiny if-at-all operating systems and very rarely contain out of the box security.

The main focus today, is generally for IoT vendors to promote interoperability - great demo's and show cases, focusing on integration or data transfer under low power or capacity constraints.

Topics such as device registration, claiming and association, data encryption or data sharing, rarely get mentioned or focused upon.

Gartner's Earl Perkins, introduced an intriguingly titled session called "Herding Cats and Securing the Internet of Things".  Earl touched up the need to have a tiered approach to IoT security, covering infrastructure, identity and data.  Whilst the devices themselves are often associated with data capture and replay, it's often the data owners - real people - who could be exposed in a data breach disaster.

Following Earl, was Trent Henry discussing how Public Key Infrastructure, the once expensive and seemingly legacy encryption approach, was having a new lease of life in the machine to machine (M2M) landscape, where username and password authentication is of limited use.  It seems logical, that the use of things like asymmetric keys (perhaps minted at manufacture time) and certificate distribution can become the defacto standard in the M2M game.

The increased popularity of things like NFC (near field communications) has opened the scope for smartphone payment technology, through the implementation of secure elements, within the phone's hardware.  Such secure elements are likely to be seen within other non-phone devices that have a requirement for the storage of credential or certificates and keys.

One of the major issues with the IoT landscape, is often associated with basic identity management, such as how devices register to a service or authoritative source and how the corresponding data owners are able to authorize and share data to trusted third parties.  Whilst the devices themselves could be simple, the data captured, is often of a high value and simple yet robust trust and privacy models need to be implemented.

Many of the newer authorization standards such as OAuth2, OpenID Connect and User Managed Access (UMA) may have a significant role to play here.

By Simon Moffatt


Save the date for the 2014 ForgeRock Identity Relationship Management Summit

The date has been set, the 2014 ForgeRock summit in United States will take place on the week of June 2nd, in Phoenix AZ.

Make sure you block the date in your calendar ! I hope to see you there.

And if you’re in Europe, don’t panic ! We are also planning an EMEA summit in the fall. The date and location will be announced later.


Filed under: General Tagged: conference, ForgeRock, identity, Identity Relationship Management, IRM, openam, opendj, openidm, security, summit