The Internet of Things is connecting just about any physical object in our environment with a growing option of users, partners, applications, 3rd party software systems and vendors. Managing and securing the growing number of things, people, and applications shuttling data to and from one another is a massive Identity & Access Management nightmare for most enterprises. In this talk we will discuss real-world scenarios for building more scalable identity management systems and how they will interact with your existing enterprise systems such as Salesforce.com.

1. An Identity Crisis at the
Center of Every IoT Product
Sean Lorenz
Director of IoT Market
Strategy
Fraser Macdonald
Product Owner

2. 2© 2015, LogMeIn, Inc
Outline
1. A brief history of IoT products & platforms
2. IoT platforms and IAM security demand
3. Xively’s approach to security & IAM

3. A DIP INTO THE PAST

4. 4© 2015, LogMeIn, Inc
Lessons from the trenches
IoT connectivity
at scale is
REALLY hard
Securing IoT
data & identities
is even harder

5. 5© 2015, LogMeIn, Inc
And the press has caught on…

6. 6© 2015, LogMeIn, Inc
What was missing?
Scalability on all levels
flexible efficient quantifiable secure

7. 7© 2015, LogMeIn, Inc
Reality sets in.
The process of building
an IoT product is still
unknown to most
companies
Nothing exists to handle
the complexity of
managing all aspects of
a connected product
business
1
2

8. © 2015 Forrester Research, Inc. Reproduction Prohibited 8
IoT platforms and IAM security
demand
Research and study results

9. © 2015 Forrester Research, Inc. Reproduction Prohibited 9
Who did we talk to?
› 100 line of business and IT executives at durable goods manufacturers
› All respondents are decision makers, influencers or participants in security
strategy for connected devices
› Geographic segmentation
• US: 64 respondents
• UK: 36 respondents
› Organization Size:
• 55%: 1,000+ employees
• 45%: 100 to 999 employees
Source: A commissioned study conducted by Forrester Consulting on behalf of Xivley, June 2015

10. © 2015 Forrester Research, Inc. Reproduction Prohibited 10
Manufacturers of connected devices are concerned with
various security issues
Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and / or businesses in the US and UK
(percentages may not total 100 because of rounding)
Source: A commissioned study conducted by Forrester Consulting on behalf of Xively, June 2015
3%
“Which of the follow security threats on your connected devices are you most concerned about?”
(Ranked by top 5, with 1 being the most concerning threat)
Rank 1 Rank 2 Rank 3 Rank 4 Rank 5
External hackers 32% 11% 9% 6% 7%
Leakage of sensitive or confidential data 9% 13% 10% 20% 8%
Viruses, network worms, and other
malicious software (malware)
7% 9% 18% 10% 13%
Lack of authentication and authorization for
access to these devices
8% 14% 9% 16% 9%
Third-party collection of device usage patterns and
data from intelligent devices
7% 15% 9% 8% 13%
Physical compromise due to intelligent
device failures
4% 9% 12% 10% 13%
Internal hackers 11% 10% 12% 6% 8%
Denial of service attacks to intelligent devices 8% 11% 8% 11% 7%
Compliance fines and penalties over
regulatory violations
3%
1%
5% 8% 14%
Safety of human life 8% 5% 6% 6%
65%
60%
57%
56%
52%
48%
47%
45%
31%
28%
Total % ranked
in top 5

11. © 2015 Forrester Research, Inc. Reproduction Prohibited 11
37%
30%
29%
29%
21%
16%
13%
Lack of standard interfaces
Diverse device universe makes interoperability
challenging
Data privacy concerns
Lingering concerns about underlying security
Lack of compelling business case to support investment
No barriers
User resistance
67% of respondents are concerned with IAM, but there are
barriers to addressing this issue
“What are the barriers preventing you from implementing additional
identity and access management (IAM) security control”
Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and / or businesses in the US and UK
Source: A commissioned study conducted by Forrester Consulting on behalf of Xively, June 2015

12. © 2015 Forrester Research, Inc. Reproduction Prohibited 12
IAM importance will continue as the number of parties
accessing device data increases
Base: 100 discrete manufacturers (of durable goods) that manufacture connected products for consumers and / or businesses in the US and UK (percentages may not total 100 because of
rounding)
Source: A commissioned study conducted by Forrester Consulting on behalf of Xively, June 2015
“Which of the following currently requires access to your connected device data?”
“Which of the following could benefit from access to your connected device in the future?”
Currently
In the future
Other connected products 26%
36%
Internal business systems and
applications
47%
46%
Sales 28%
27%
Marketing 31%
42%
IT 62%
48%
Operations 47%
42%
Field service reps 28%
33%
Finance 20%
22%
HR 12%
11%
Customers 46%
44%
Vendors 37%
42%
Distributors 19%
31%
Suppliers 18%
33%
Average of four
parties require
access today
Average of five
parties will
require access
in the future
Business systems
and technology
Internal
business units
Third parties

13. © 2015 Forrester Research, Inc. Reproduction Prohibited 13
Manufacturers seek similar capabilities among
vendor partners for IoT and IAM solutions
49%
37%
33%
30%
29%
28%
28%
23%
23%
22%
18%
18%
55%
36%
33%
28%
28%
28%
23%
20%
24%
26%
18%
18%
Security expertise
Reliable solutions
Technical expertise
Multinational player
End-to-end turnkey solution
Solution integration expertise
Vertical industry expertise
Customer service and help desk support
Regional presence
Scalable solutions
Expertise in my legacy applications
Partner ecosystem
IoT partners IAM partners
“What are the capabilities you are looking for in your Internet of Things (IoT) solution or IAM partners?”
Base: 100 Discrete manufacturers (of durable goods) which manufacture connected / IoT products for consumers and/or businesses in the US and UK.
Source: A commissioned study conducted by Forrester Consulting on behalf of Xively, June, 2015

14. © 2015 Forrester Research, Inc. Reproduction Prohibited 14
Key takeaways to enable your connected product
journey
› Proactive manufacturers are deploying connected devices to differentiate products and
transform customer relationships
› Firms are in the early stages of deploying IoT software platforms
• Key functions: Connect, secure, manage, analyze and engage
• DIY is the main competitor today
› Identity and access management (IAM) features are emerging as important security elements
• IAM demand will increase as more stakeholders access connected device data
› Manufacturing firms seek IoT solution and IAM assistance from vendors with security and
technical expertise

15. THE XIVELY APPROACH TO IAM

16. 16© 2015, LogMeIn, Inc. | CONFIDENTIAL – FOR INTERNAL USE ONLY
Security at the heart of an IoT platform
1. Secure by design
Ø Xively was built FOR IoT and was built secure
2. Device security
Ø Requirements: Very strict requirements for device
itself – hardware requirements include having a real-
time clock, crypto random number generator etc. and
software requirements include time synchronization
etc.
Ø Up-to-date client library
Ø Device-level rate limiting
3. Secure in transit
Ø Xively mandates use of secure and strong TLS over
all communications protocols (and supports HTTP,
WebSockets and MQTT)
4. Securing data at rest
Ø Storage encryption with Amazon Web Services
5. Identity Access Management
Ø Blueprint manages identity of users/customers/
devices
Ø Uses OpenID Connect protocol for to identify/
authenticate vendor’s users/customers
Let’s take a look at threats in the IoT
realm and discuss what an IoT platform
must do in order to mitigate risk. Below
is a STRIDE-based IoT Platform Security
Checklist covering the following threat areas:
• Spoofing – Pretending to be something
or someone you’re not
• Tampering – Modifying something you’re
Lastly, in order to develop a comprehensive
IoT threat landscape with STRIDE, Xively
has dedicated a lot of time to helping its
customers account for all the various actors
within an IoT ecosystem during the design
stage of development:
• Devices – Physical products connected
to the Internet via the Xively platform;
XIVELY’S APPROACH TO SECURITY
Encryption
Crypto
on

17. 17© 2015, LogMeIn, Inc. | CONFIDENTIAL – FOR INTERNAL USE ONLY
Introducing BlueprintTM
Master Directory of Your Connected Business
Objects Attributes Rules
• Main directory of all your
users, products and
organizations
• Catalog of things that will
interact with your connected
products
• Describes and stores useful
information about all your
objects
• Examples: name, setting,
status, serial number,
location
• Connected businesses
policies and relationships
• Defines and manages
security, trust and
relationships among objects
• Interaction with other
business systems (CRM/
ERP)

18. 18© 2015, LogMeIn, Inc. | CONFIDENTIAL – FOR INTERNAL USE ONLY
What Blueprint now enables
Identity Management
Let a customer create and invite new users
Authentication
Allow existing users to sign in, return an ID
that is used across all microservices.
Provisioning
Securely orchestrate the distribution of credentials to
new devices, and their association with end users.
Authorization
Define the roles and permissions that govern how
entities message and manage each other.

19. Thanks.
@XivelyIoT | xively.com