The Stuxnet attack and the recent attacks against the Ukranian power grid were a wake-up call to improve the security of our critical infrastructures, which include the smart grid, transportation networks, water distribution, and other industrial internet of thing systems (IIoT).

This class covers the security of the IIoT, focusing on the industrial networks, and the embedded controllers used to control our infrastructures, and discusses the possible attacks and defenses to improve the security posture of these systems. In addition to security, we will cover the privacy of Internet of Things (IoT) devices. In the 21st century computers have a variety of sensors that collect information about the world around them. This ability of IoT devices to passively sense surrounding activity makes the privacy issues they raise distinct from the privacy issues raised by traditional computing systems. As they collect physical data of diverse human activities such as electricity consumption, location information, driving habits, and biosensor data at unprecedented levels of granularity, their passive manner of collection leaves people generally unaware of how much information about them is being gathered. People are additionally generally unaware that such collection exposes them to possible government surveillance or criminal targeting, as the data collected by corporations can be obtained by other actors through a variety of legal or illegal means. For example, automobile manufacturers are remotely collecting a wide variety of driving history data from cars in an effort to increase the reliability of their products. Data known to be collected by some manufacturers include speed, odometer information, cabin temperature, outside temperature, battery status, and range. This paints a very detailed map of driving habits that can be exploited by manufacturers, retailers, advertisers, auto insurers, law enforcement, and stalkers, to name just a few.