Joe Weiss is 100% correct. Many companies talk about security, but their management team has no idea what is going on or what is required for information security processes to be successful for their product. I worked in the area of information security for many years before moving into higher education where I teach courses in this area. We still have a long way to go before companies understand that security should always be at the top of the list.
The current security paradigms are moving away from most of the defenses being at the gateway to the system, because it leads to targets that are described as "crunchy on the outside but soft on the inside". Based on that many would advise making these controllers more resistant to attack. Unfortunately, they are relatively unsophisticated devices. What needs to happen is the creation of an effective strategy to protect their programming. For example, you could set up a disconnected computer to program them (the "air gap" that was described in the article) and set up strict scanning protocols for both that machine and media used to transfer files to it.
This works as long as the controllers can be effective on disconnected systems. Unfortunately from a security point of view, they are most efficient when feeding their data to a network. This requires very strong network configuration and monitoring, but if it can be separated from the programming interface that might be effective.
What are the engineering and design challenges in creating successful IoT devices? These devices are usually small, resource-constrained electronics designed to sense, collect, send, and/or interpret data. Some of the devices need to be smart enough to act upon data in real time, 24/7. Are the design challenges the same as with embedded systems, but with a little developer- and IT-skills added in? What do engineers need to know? Rick Merritt talks with two experts about the tools and best options for designing IoT devices in 2016. Specifically the guests will discuss sensors, security, and lessons from IoT deployments.