Assessing Increasingly Complex IoT Threats

There has been a steady uptake of IoT as the number of organizations that use the technology increased from 13 to 25 percent between 2014 and 2017. Experts estimate that the global number of IoT connected devices will increase threefold to 43 billion between 2018 and 2023. Total spending on endpoints and IoT services will reach $3.9 trillion this year.  

However, as IoT evolves, cybercriminals are devising frequent and sophisticated tactics to compromise critical systems based on this technology. Typically, a hacker will exploit weaknesses in an IoT device to cause advanced persistent threats (APTs) such as the distributed denial of service (DDoS) attack. For instance, in the famous 2016 Mirai botnet incident, cyber actors deployed old routers and security cameras to launch a vast DDoS attack against Dyn, a DNS provider. The incident brought down popular services, including Netflix, Twitter, Reddit, and CNN. In a different incident, hackers gained unauthorized access to a casino’s information system through a Wi-Fi-enabled fish tank.

Organizations should reevaluate the security of the IoT sector to achieve sustainable value. Back in March, we covered how IoT technologies impact FinServ Productivity and Cybersecurity. Delivering reliable and effective protection for the IoT requires assiduity in secure hardware development and software design throughout the product lifecycle. Developers should build security controls into the software development lifecycle and resilience testing to detect and mitigate flaws that lead to a breach. 

Challenges of Securing IoT

Indubitably, IoT solutions feature different value chains and an expansive attack surface. The IoT ecosystem consists of connected objects such as wireless production sensors, actuators, environmental sensors, industrial equipment, medical devices, kitchen appliances, and thermostats that convey usage and other relevant data insights. An understanding of the whole system is necessary for security personnel to identify threats and implement mitigation controls. 

Additionally, adequate security requires specialized domain knowledge of various technologies in the IoT supply chain. IoT vendors require personnel with an understanding of electrical engineering, hardware components, software development, and networking protocols. 

Another challenge is that many IoT manufacturers deliver IoT devices with default login credentials that end-users fail to change. Consequently, hackers can effortlessly access the devices and the broader network using the passwords. In other cases, vendors may produce IoT solutions that lack proper encryption of data as it moves from the device to the core system.

Furthermore, a wide range of IoT devices lack sufficient memory and processing power to download and install updates online. This becomes challenging for the IoT vendors to provide ongoing support and security patches during the product’s lifespan.

Enhancing IoT Security

Securing IoT is much more than the device protection. It entails safeguarding how and where the devices connect to the network, as well as how they process, store data, and interact with end-users. More importantly, it’s a team effort that involves multiple parties.

Security Teams: As mentioned above, the process requires a secure hardware design, software development, and resilient testing. However, meeting the goals is knotty due to the intricacy of the IoT ecosystem comprising divergent platforms and devices. It is desirable for security teams to streamline the implementation of intricate security controls in a firmly integrated technology stack. This approach establishes a secure foundation that IoT developers can deploy to mitigate flaws during the product lifecycle. Following this, security teams need to review the architecture and model threats of software and infrastructure during IoT solutions development.

Device manufacturers: Manufacturers should invest resources in developing and releasing security patches and updates for IoT devices. Automated testing and fuzzing help identify security issues rapidly as vendors develop IoT components. For instance, security teams can test if vendors allow the use of default login credentials that hackers can exploit after delivering an IoT device to customers. Likewise, IoT sellers should apply proper encryption on data stored or transmitted from a device to an enterprise network.

Businesses: Organizations can install firewalls around IoT systems to contain a data breach. The devices can also run on a separate network from other company systems. Additionally, they can limit connectivity and access for IoT systems whose functionality is not dependent on the open web. System administrators can also implement permissions controls for what IoT devices can download or share. Notwithstanding the security controls put in place, businesses should monitor their networks for suspicious activities allowing them to respond to an attacker’s actions as they gain access to a network through an IoT device.

Creating Secure IoT Ecosystems with ISA

Ultimately, organizations exploring IoT opportunities will encounter numerous security challenges. Last year, Kevin Dawson – CEO of ISA, addressed the evolution of IoT technologies and the cybersecurity approach needed to tackle the increasing threats. Cybersecurity has become an increasingly essential aspect of IoT architecture development. At ISA, we understand that flawed IoT systems provide an attractive door to ostensibly secured company networks. At the same time, secure deployment, connection, and management of a wide range of IoT devices and platforms is overwhelming. It involves the analysis of overwhelming security logs and an understanding of IoT fundamental components such as electrical engineering, coding, network protocols, and APIs.

Companies investing in IoT technology should implement several measures to protect their IoT systems from increasingly sophisticated and frequent cyber risks. Partnering with ISA offers a business the capability to build and effectuate a robust security strategy for IoT architectures. The ISA team is well versed in IoT security best practices and has developed systematic approaches to help businesses gain visibility into the nature of risk. Contact ISA today for a demo.

­­­