Transcript 0:00 [upbeat music] Welcome to the Peggy Smedley Show, the podcasting voice of IoT and digital transformation with your host, Peggy Smedley. 0:21 Hello, listeners, and welcome to today's edition of the Peggy Smedley Show. As always, I'm your host, Peggy Smedley. To kick off this week's podcast, I'd like to talk about security, and in particular, payment security. 0:35 A new report has come out that delves kind of into security and compliance, and today in this first segment, I'd like to share some key lessons and takeaways. 0:45 What are the compliance challenges organizations face, and how organizations can address them. 0:51 Later on in the show, I'll also be interviewing Emily Lyon-Solberg, VP of Product Management for the Internet of Things at AT&T, and then I'm gonna wrap up the show with John DeJulius, author of The Re- Relationship Economy: Building Stronger Customer Connections in the Digital Age. 1:11 So again, I've got a great show for you. So let's get started. 1:14 A new report on payment security was released, and I'll focus on that in just a minute, but first, why don't we kind of get up to speed on what's happening right now in IoT security, because I think this is pretty interesting. 1:28 And I'm gonna start with some overseas news a little bit. The Australian government and the Australian Cybersecurity Center just introduced a draft of a voluntary code of practice for securing the Internet of Things. 1:43 Now, I find this very interesting because the goal is to provide some guidance in the form of best practices to help improve the security of consumer-connected products. 1:55 The code of practice is basically voluntary, but the government wants the measures included within the code of practice to become the new standard for IoT devices. 2:07 So here are the principles Australia is including in its code for device manufacturers, IoT service providers, mobile application developers, and retailers. No duplicated default or weak passwords. 2:24 Entities must implement a voluntary disclosure policy. Entities must keep software security updated. They must securely store credentials and security-sensitive data. 2:38 They must also ensure that personal data is protected, minimize exposed attack services, ensure communication security, ensure software integrity, make systems resilient to outages, monitor system telemetry data. 2:57 Entities must also make it easy for consumers to delete personal data, make installation and maintenance of devices easy, and finally, validate input data. Now, think about all this. 3:11 These are really some great principles and best practices, and I would love to see more governments getting serious about protecting IoT devices and ultimately all of us consumers. 3:26 Now, here on US soil, we're getting really close to that January 1st start date for California's new IoT security law. Now, the law is the first of its kind in our country. 3:39 It requires connected device manufacturers to equip devices with reasonable security features. 3:46 Now, let's talk about reasonable security features that can help protect devices and any data on those devices from unauthorized access, use, or modification. 3:59 Similar to the Australian government's best practices, the California IoT security law also calls for unique passwords for each manufactured device. 4:11 While we've talked in more detail about this legislation before, now we've talked about it right here on this show, I want to put it back on your radar right now because January 1st is almost right upon us. 4:24 I know we get caught up on so many things with the holidays, and I think this law is really going to set the tone for 2020 in terms of IoT security. 4:33 I think 2020 we've really got to focus on security, and we can't get lackadaisical about security. But now let's dive into payment security. 4:43 Verizon's 2019 payment security report just came out, and I found it interesting to follow the series of reports over the past years because I think it's always interesting when we talk about these things. 4:55 It's been sixteen years since organizations have started needing to comply with regulations for payments and data security, and a lot has changed since then in terms of how people pay for goods and services. 5:09 But one thing hasn't changed, and that's for sure, and that's the prevalence of paying with payment cards. The theme of Verizon's report this year is performance, visibility, control, and maturity. 5:22 One key takeaway for me when I looked at this, and really g- delving into and reading this report, is the importance of developing a proactive strategy and program design for information security. 5:35 Reactive design without advanced planning isn't going to cut it, not with how sophisticated cyber criminals are today. 5:44 Now think about that, because Verizon suggests a reactive strategy is often disjointed, and I have to agree, because we always just... This reactive way of doing things just isn't gonna cut it. 5:56 But another key takeaway that I really thought was important was flexibility.The winning businesses are those that go in with the best strategy, but also have the flexibility to adjust to changing conditions and evolving threats. 6:14 Because you know what? Things are always happening. We know society's always changing. An important part of this report that I also want to mention is actually about compliance. 6:25 Now, we know the importance of compliance, but think about this: what are the compliance challenges all of these, all of you in firms, all your businesses are facing? What are you thinking about? 6:37 So Verizon lists the following constraints that lead to compliance program pitfalls, and I want to mention them here. Constraints include commitment, communication, competence, capability, and capacity. 6:54 Now think about that. 6:55 If your organization lacks compliance support from leadership, if your compliance program isn't competing with other organizations' priorities, or if there's not enough communication and/or training surrounding your company's compliance program, then you're facing potential issues. 7:17 Now, I really don't have to tell you that. I think all of you listening right now agree with that. But the fact is, you have to really be thinking about these things, and you have to be focusing on them. 7:28 Perhaps your organization isn't really assessing and understanding the risks associated with security and compliance. Those are the things. That would fall within the competence category. 7:42 That's what you need to think about. In terms of capability constraints, an enterprise overall may lack clear procedures resulting in policies that seem impossible to navigate or adhere to. 7:56 Again, that's what we're talking about. Companies may also suffer from not having enough resources to monitor their compliance programs like they should, which can lead to issues. 8:08 Now, we talk about the lack of people, the lack of the resources, and the measures that you need to do. And in today's society, you have to have the right efforts and resources when it comes to security. 8:21 You can't skimp on security, not today when we have the cyber criminals who are always out there. The bad guys are always looking to do bad things, so we've got to put the right resources to cybersecurity. 8:33 So I guess what I would say in a lot of these things when we're thinking about it and we're focusing on it, there's a lot happening in today. 8:39 And, and with all these connected devices, and we think about the 2020 and the next decade, and as we head into the new year, we've got to be focusing on where our mind, our energy, and our hearts are dedicated. 8:51 So here's what I want you to think about. 8:54 So if you're a business that depends on payment security, you need to be looking not only at the threat landscape for payments, but also the common pitfalls for compliance programs. 9:07 In the end, your ability to comply with industry regulations will impact your ability to keep payments secure, and that's very important, and I think sometimes we're not necessarily thinking about that, but you have to think about it when 2020's coming, because I think it's extremely important to focus heavily on that. 9:28 And again, here's my opinion for today. Security is going to continue to be a topic of interest in 2020. I think it's going to be one of our biggest points of interest in 2020. 9:40 We are going to see some big breaches and hacks. We've already seen them. There's just no way around it, and it's going to continue, but don't let it happen to you. 9:49 If you're a device manufacturer or IoT service provider or mobile application developer, you need to make sure you're following industry best practices for protecting connected devices and services, as a result, your end customer. 10:05 You need to be focusing on that. If you're a consumer, you need to be proactive about figuring out how companies are using your data and whether your IoT devices are as secure as possible. 10:18 This is so very, very important. Um, unfortunately, as I've said so many times before, the bad guys are always on the lookout for the weakest link in the chain, and we've got to always keep that in mind. 10:33 We can all work together to try to make sure we're not the weakest link in whatever chain or chains we're part of, and that's what's so very important. 10:42 And I think when we are working together and we are keeping those bad guys at bay, we're actually doing the best thing, and when we think about all the security breaches and the hacks that we've seen already in 2019, we have to be aware that no matter what we do, we've got to be vigilant. 11:00 We've got to be aware of what's happening. But by being aware, we can actually do the best things to make our devices secure. 11:08 And we're already seeing what the Australian government and what the Australian Cybersecurity Center has just introduced, their voluntary code of practice. That's something we need to be thinking about here in the US. 11:21 The best things we can do are the best ways we can do, and now we're seeing what California's introducing. Other states might introduce that. 11:27 We never like regulation, but sometimes we need to do something to make sure all of us are safe and secure. 11:34 Well, as always, if you have thoughts on what I've talked about today, please send me a tweet to continue this discussion on social media at ConnectedWMag. 11:44 You know, if you're sending me thoughts, those are the most important. All right, so check out our website at connectedworld.com or our show website at thepeggySmedleyShow.com. 11:53 Now I'm gonna take a quick commercial break, but then I'm gonna be back with Emily Lyon Solberg, the Vice President of Product Management of the Internet of Things AT&T, and she's got a lot of things to share with us. 12:04 So remember, this is The Peggy Smedley Show, the podcasting voice of IoT and digital transformation. And remember, with great technology comes great responsibility. Go get that cup of coffee, and we'll be right back. 12:14 [outro music]
