You think you have secured your endpoints with latest and greatest tools. What if the attacker can steal your data without touching your endpoints?

RSAC demo - IoT was  hacked to steal PII. 
In the demo, the IoT device need not be directly connected to the target network device. It doesn't require sophisticated hacking skills — Metasploit tools or the Linux command line will suffice

The attack begins with an exploit of a surveillance camera via the Devil's Ivy vulnerability — a remote code execution vulnerability in an open source gSOAP library that was discovered by the Senrio team last summer. A patch for the vulnerability already exists but was not applied to this camera model — and that's not unusual.

Once the camera is compromised, the attackers then have a bird's-eye view of an employee at his workstation and the items on his desk — which include a router and a network access server (NAS). The attackers can then watch the user's keystrokes when logging in to the NAS.


How can enterprises defend against attacks like these? Carlton takes a deep breath. 

"First, find what [IoT] devices are on your network," she says. "Then we'll talk."  

https://www.darkreading.com/vulnerabilities---threats/first-public-demo-of-data-breach-via-iot-hack-comes-to-rsac/d/d-id/1331588