Aertrak Internet of Things (IoT) Security Platform

Assessing and identifying threats before they cause critical harm to assets with IoT Security

ROLE

Design strategy
Design thinking
User research
Interaction design
Prototyping

TOOLS

Figma
Anonymized internal data

TEAM

Product Design Lead
1 Product Manager
1 Engineering Manager
2 Engineers
1 Researcher
1 Product Designer

KEY RESULTS

First effort MVP successful with Aeris "inner circle" customers

Rapid roadmap buildout to include block and suspend functions and emerging AI solutions

Later released as Aeris IoT Watchtower

THE BUSINESS

Aeris Communications is a cellular IoT solutions company that helps many of the world’s largest companies create value through connected technologies.

Aeris AerPort is an IoT connectivity management platform that helps businesses manage and optimize their connected devices throughout their entire lifecycle, including Device Management, Billing and Cost Management, Location and Tracing, Real-time Insights, Alerts and Notifications, Connectivity Optimization, and APIs for custom integrations.

THE CHALLENGE

After several high profile vulnerability attacks on Fortune 100 companies covered by media, IoT Security became top-of-mind in 2022 as a viable product differentiator. The IoT market had become rapidly commoditized on price and entrants unconcerned about security.

I partnered with a newly hired Product Manager focused on differentiating the Aeris product portfolio by integrating a strong focus on IoT Security inside the company's flagship application, Aerport.

GOALS

Data Operators: Create a process for Data Operators to identify and assess security threats to minimize vulnerablities.

Finance: Robust cybersecurity controls as a cost-containment measure. Compromised devices could be auto-suspended, which could pause billing for affected devices.

KICKING OFF

What did we know about the IoT security space, and what was important to our users? Research and interviews began.

External Research:

• As a result of increasing threats and tightening regulations, the global IoT cybersecurity market revenue is projected to more than double over the next five years.
• IBM's Cost of a Data Breach report, the global average cost of a data breach is $4.44 million and it takes an average of 241 days to identify and contain an active breach across all industries.
• The US Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requires organizations in national security, finance and other designated industries to report cybersecurity incidents affecting personal data or business operations to the Department of Homeland Security within 72 hours.
• US organizations subject to the Health Insurance Portability and Accountability Act (HIPAA) must notify the US Department of Health and Human Services, affected individuals and sometimes the media if protected health information is breached.
• All 50 US states also have their own data breach notification laws.
• The General Data Protection Regulation (GDPR) requires companies doing business with EU citizens to notify authorities of breaches within 72 hours.
• Top IoT Device Vulnerabilities

Competitive Overview:

Reviewed competitive offerings from Twilio, Hologram, Cisco, IBM, GE Digital and Verizon
 

Internal surveys:

Initial survey (and later interviews once testing commenced) of Aeris "inner circle" users -- customers that respresent annual recurring revenue (ARR) brackets to kickstart continuous improvement and feedback loop. 

• Cybersecurity is very important to our $1m+ users
• Cost is important to our <$1m users
• Customer experience is important but outranked by performance, cost and cybersecurity
• Explore opportunity to introduce cybersecurity tools as a market differentiator at possible additional cost
  
  

INITIAL INSIGHTS

Interviews and research highlighted what our team labeled as four "Potential Indicators of Compromise":

• Data transactions (per device): Average bytes to and from devices per transaction
• DNS queries: Total queries to public and private DNS servers
• Destination endpoints: Number of endpoints that your devices communicated with
• Data volume (aggregate): Total data transmitted, across all devices

Also surfaced were identifiers for security risk:

• Network Security
• Privileged Access
• Data Protection
• Asset Management
• Vulnerability Assessment
• Endpoint Security

This led to explorations of a possible security score to assess device strength initially based on 10 criteria, expressed as a percentage. 

IDEATION & FLOW

From rounds of interviews with Aeris inner circle, and working with the product manager, we determined an initial set of user needs:

• Receive alerts via text, email or desired notification approach
• Understand alerts in Security Center and  and receive well-crafted assistance if they don't
• Clear overview of network security on dashboard, with  score and most recent data for potential indicators of compromise
• Provide assistance for the user to find which devices might be compromised
• Identify SIMs or be able to identify the traffic path of an individual SIM
• Measure reputation score of IP address
• Utilize IP database from external and internal sources (Talos, Spamhaus, additional services as appropriate)

PROTOTYPE

Utilizing our existing design system and design patterns, we were able to rapidly composite a prototype in Figma:

REFLECTION & LEARNINGS

As a first effort MLP (Minimum Loveable Product), there was much room to grow.

• The first release allowed users to identify SIMs where there was a high probability of compromise.
• From feedback and continuous testing, the team was able to quickly grow a six-month product roadmap to cover second and third releases based on continuous feedback and regular user testing sessions.
• The second release allowed for blocking URL access and suspending SIMs that might be compromised, for investigation or replacement in client asset fleets.
• Subsequent releases looked into utilizing then-emerging AI algorithms to identify threats, to supplement internal and external threat databases.

Hey there, this is the default text for a new paragraph. Feel free to edit this paragraph by double clicking on it. After you are done just click on the michael[at]mocreate.com Fun!