Teaching People to Use AI Without Security Is Half a Lesson

INTRODUCTION When people hear “IoT security, [https://itsec.asia/services/ot-ics-cybersecurity]” they often assume it’s something only IT teams need to worry about. In reality, IoT security affects everyday users, households, and businesses alike.* From smart home devices to office surveillance systems, connected devices are now part of critical daily operations. The more devices we connect, the wider the potential attack surface becomes. Here’s the part no one really talks about: Many IoT environments are deployed quickly for convenience, not necessarily designed with security as the top priority. It’s not negligence. It’s just how fast technology moves. Source: aciano.net [https://aciano.net/blog/iot-security-risks/], cio.com [https://www.cio.com/article/3990581/iot-security-challenges-and-best-practices-for-a-hyperconnected-world.html?] THE IOT LANDSCAPE NOWADAYS Security used to focus on protecting networks with firewalls and perimeter defenses. Today, attackers are shifting their focus to easier targets: user credentials, weak device authentication, misconfigured cloud dashboards, and unpatched firmware.  Today, attackers are more interested in: * User credentials * Weak device authentication * Misconfigured cloud dashboards * Unpatched firmware IoT devices often rely on cloud platforms for monitoring, analytics, and control. That means IoT security is no longer just about the

Quantum computing has a talent problem hiding inside a technology problem. The discussion around post quantum cryptography often starts with algorithms. NIST has already standardized the first post quantum algorithms and continues to update technical standards. In June, it released working drafts for bringing post quantum cryptography into Personal Identity Verification credentials, including a model that supports gradual migration from classical cryptography. NIST also finalized updated crypto agility guidance on 29 June. The concept is straightforward: organizations need the ability to replace cryptographic algorithms and implementations without causing major disruption. Doing that requires people who understand considerably more than the names of new algorithms. FIRST, FIND THE CRYPTOGRAPHY Ask an organization where it uses encryption and the first answers may be predictable: VPNs, databases, certificates and websites. Keep looking and the list grows. Cryptography can be embedded in applications, APIs, identity systems, cloud services, hardware, third party software, backups, digital signatures and old systems that everyone politely avoids touching. Preparing for a cryptographic transition therefore requires capabilities such as: * Discovering where cryptographic algorithms,

A suspicious connection appears in a corporate network. The security team investigates, isolates the affected system and starts remediation. In a conventional IT environment, that may be a reasonable first response. Now imagine the affected system controls part of an electricity substation, a water treatment facility or an industrial production line. Isolating it without understanding the operational consequences could disrupt a process that needs to remain stable and safe. This is one of the defining challenges of operational technology (OT) security. NIST's Guide to Operational Technology Security explains that OT systems interact with the physical environment and operate under specific performance, reliability and safety requirements. Security decisions must account for those requirements alongside confidentiality and integrity. [https://www.google.com/s2/favicons?domain=https://www.nist.gov&sz=32] NIST +1 For cybersecurity workforce development, that changes the training equation. KNOWING THE NETWORK ISN'T ENOUGH OT environments include industrial control systems, supervisory control and data acquisition (SCADA), building automation and other systems that monitor or control physical processes. Their operating requirements can differ considerably from those of ordinary business IT. [https://www.google.com/s2/favicons?domain=https://www.nist.gov&sz=32] NIST A security practitioner working in this environment needs