We’ve experienced an explosion in automation, connection, intelligence, and possibilities when it comes to our information technology. From the way we store data in the cloud to being able to control functions of our homes with the tap of a mobile app, innovation and convenience have superseded security.
Many companies have focused on securing their desktops, laptops, servers, phones and tablets – but what about the Internet of Things (IoT)? Connected devices on our wrists, in our living rooms, and helping improve the driving experience are the next frontier for hackers. With an estimated 6.4 billion devices already in circulation, we’re almost to the point where there’s an IoT device for every person on the planet. By 2020, devices will outnumber us by almost three-to-one.
Given the proliferation of cyberattacks worldwide – with no signs of abating – we clearly still need to contend with how to secure these IoT devices to prevent data from falling into the wrong hands. The seemingly minor issue of leaving default passwords enabled on security cameras and digital video recorders turned into a major security flaw, as the Mirai botnet fueled a massive distributed denial of service (DDoS) attack against domain name system provider Dyn in October 2016. As recently as March 2017, IBM X-Force researchers found a new variant of the Mirai botnet attempting to mine Bitcoins using compromised IoT devices.
Connected cars are among the latest IoT devices to come under scrutiny. Earlier this year, it was reported that four major auto manufacturers left security and privacy gaps in the mobile apps controlling their connected cars, allowing previous owners to geo-locate, unlock and control the vehicles in unintended ways.
New vulnerabilities in products are discovered frequently, eroding consumer confidence. Here are five things you need to know about IoT security:
- Long-lasting software security is sorely lacking: All software needs to be patched eventually. Manufacturers need a way to get IoT sensors and devices patched in very distributed and uncontrolled environments, providing updates for the life of the device. Given how many IoT devices are created today, there is a lack of accountability all the way down the value supply chain from manufacturers to resellers.
- Hackers can exploit default passwords faster than people can change them: Default or hard-coded credentials can quickly become security issues. The Mirai attacks demonstrate how malware takes advantage of such a situation to take over IoT devices for DDoS tsunamis. Organizations need to design devices that prompt a change of passwords on the first use.
- Configurations are only as strong as the user who changes them: The default configuration of an IoT device persists unless changed by the user. If manufacturers ship IoT devices in the least secured state, it is the responsibility of the device owner to take measures to improve that security. If vendors set the default configuration to the most secure choice, users must consciously select more secure options.
- Data lifecycle management matters: IoT devices accumulate massive amounts of personal data, such as voice searches, GPS locations or heart rate information. If the data isn't managed and secured, it could lead to loss of privacy and issues of data ownership. Choose vendors that can be trusted with personal data.
- Consider the environment where your IoT devices will run: IoT devices often operate without any human supervision. Look for devices that are resistant to physical tampering and have an ability to alert a central command center if they are under attack. Ensure that your IT administrators have visibility and control to safely decommission devices that either fail or have been compromised.
Securing IoT should be the responsibility of everyone – from developers and manufacturers to cybersecurity professionals and IoT consumers themselves. Unfortunately, the developer and manufacturing communities have failed so far, and user education can take a long time.
As someone responsible for cybersecurity, you need a trustworthy, layered defense that handles every layer of your infrastructure. Look no further than Cyber Vault. We are vendor agnostic and choose only the best layers of defense for you: DDoS, NextGen firewalls, WAF, advanced malware protection, IPS/IDS, DLP, SIEM, SOC, endpoint, anomaly alerting, and log analysis. Specifically, our endpoint protection can handle on-premises, cloud infrastructure, and up to one million endpoints. Cyber Vault defends against malware that exploits memory and other scripting languages, while we continuously record and centralize all endpoint activity, giving your incident response team real-time attack intelligence to greatly reduce dwell time and damage to your company.
To learn more and to request a quote, visit our website today.