Smart Home / IoT, Threat & Vulnerability Management (TVM) & B2C Delineation for Vendors

As the smart home becomes a reality (https://www.theverge.com/2017/12/20/16799918/homekit-vulnerability-details) so does the need to monitor & patch said smart home.

But, who from a vendor standpoint will own that market / responsibility (ISPs, Utilities, Alarm / Physical Security, AV software vendors, separate vendors: Amazon / Apple / Google / Staples: Geek Squad, B2C MSSPs / SOCs)?

The answer will vary depending on the jurisdiction / age of the house, though this wrestling match is sure to come.

So, wait & see how this shakes out, because change is coming for sure.

IoT Architectures & Solution Providers

As IoT gains steam towards critical mass & orgs look to embrace it, mgmt. must ask how to deploy it properly (e.g., design patterns: http://www.internet-of-things-research.eu/pdf/Converging_Technologies_for_Smart_Environments_and_Integrated_Ecosystems_IERC_Book_Open_Access_2013.pdf) & whom to leverage for SME-based services.

Amazon, Microsoft, & Cisco (among others) have now rolled out IoT mgmt. svcs; so, who to use?

Well, if an org has a considerable investment in one of these providers then go ahead & continue on.  But, if not, the question begs who do we leverage for authentication?  If an org has Cisco ISE deployed already, then leverage that.  Otherwise, stay w/ a cloud solution.

Identity & Access Management (IAM / IdAM) Programs

IAM / IdAM / Single Sign-On (SSO) / Privileged Access Management (PAM) / Multi-Factor Authentication (MFA) / Identity Providers (IdP) / Identity Federation are all part of a program that enterprises should focus on these days.  And, these programs need to be able to extend to multiple technologies: cloud, mobile, IoT, ERP, etc.

However, these endeavors are treated as one-offs. 

As organizations wrestle with business transactions (merges, acquisitions, divestitures), the need to have a formal, organized IAM / IdAM program grows in need.