Securing the connected products of a multi-brand manufacturer

The project

A diversified industrial technology manufacturer builds connected products used in professional and industrial settings. Many of those products were standalone in their early years, then became part of an IoT ecosystem connected over wifi. That shift widened what each product exposed to the outside world. At the same time, the company’s own customers increasingly expected proof, sometimes written into contracts, that the products they were buying were secure.

That’s a product security obligation, and it reaches beyond traditional corporate IT: it covers what the company ships to its own customers. One of the manufacturer’s operating companies came to Winmill’s application security practice to meet it.

The challenges

• Product security, not just corporate IT. The security obligation covered the products the company sells, so protecting internal systems alone wouldn’t satisfy it.
• A widening attack surface. Products that once stood alone now connect over wifi as part of a larger ecosystem, opening them to new classes of vulnerability.
• Customers demanding evidence. Buyers wanted proof the products were secure, in some cases as a contractual requirement.
• More than code. Many products ship with companion mobile apps and cloud repositories, so security spans the devices, the apps, and the cloud behind them.

The solution

Winmill helped the operating company evaluate application security options against its environment and requirements, then procured and put in place the solution that fit. Because these products are more than code, the security lens covered the full connected surface: the application itself, its companion mobile apps, and the cloud services behind them.

The results

• A successful first engagement. The operating company got the application security solution it needed, and the engagement delivered.
• Trust that scaled. On the strength of that success, the parent company negotiated with Winmill to provide penetration testing across most of its operating companies.
• Continuous validation. Winmill now delivers ongoing penetration testing through the Penetration Testing Stream subscription for about ten of the manufacturer’s operating companies, giving each one repeatable proof of security as its connected products keep evolving. Read how the program works in practice.