Endpoint

2/24/2015
08:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

5 Ways To Prepare For IoT Security Risks

As the Internet of Things begins to take shape, IT organizations must prepare for change.

Enterprises can expect to see some fundamental changes in the information security and data privacy landscape as the Internet of Things (IoT) begins to take shape over the next several years.

The sheer diversity of IoT assets and the myriad ways in which they connect with each other and the enterprise network will raise new IT governance and cybersecurity challenges, Verizon said in a status report on the IoT market this week. Dealing with the changes will require a new way of thinking about IT security and management, the report noted.

“Because IoT is all about physical “things,” hackers that gain access can not just perform the usual digital attacks like stealing data, moving money, or shutting down websites,” Verizon said. They can also cause physical havoc by tampering with critical infrastructure like electric grids, SCADA systems, healthcare devices, and aviation systems.

For the most part, the Verizon report offers a review of how organizations in different industries have already begun deriving measurable business value from IoT projects. As examples, it points to transportation companies that are saving millions of dollars on fuel consumption by using IP-enabled devices to track and manage fleets, local governments stretching their budget dollars via smart street lighting projects and utilities improving operations via smart meters.

Organizations across sectors are harnessing IoT technologies to increase revenues, improve operational efficiencies and find new ways to do thing, Verizon noted.

But the trend also presents new challenges, Verizon noted. Every Internet-enabled sensor and device in an IT environment presents a potential security risk. Verizon pointed to a 2014 report by Hewlett-Packard showing 70 percent of the most commonly used IoT devices, such as smart thermostats and home security systems, contain serious security vulnerabilities.

Even the most security-conscious organizations may be unprepared for the full security impact of a world in which tens of billons of devices and things are connected to the Internet, the report noted.

Johan Sys, managing principal of identity and access management at Verizon Enterprise Solutions, says as more things join the established Internet, they are likely to present the same kind of attack opportunities as the devices that first made up the Internet. “As long as there is value in the information exchanged by connected devices, there will be malicious actors who will attack the applications running on the network,” Sys said in emailed comments to Dark Reading. There are several measures that organizations can take to prepare for the risks, he said.

1. Bake security into IoT applications from the start

Because of its highly interconnected nature, the IoT amplifies the impact of security vulnerabilities, says Daniel Miessler, an HP security researcher involved in the 2014 IoT report. “We have broken network security, broken web security, broken cloud security,” he says. “What the IoT does is take all of these vulnerabilities and smash them together into one product. We should not be surprised there are issues,” Miessler says.

One of the first things developers of IoT applications should focus on, according to Sys, is building in security from the start. “This needs to include ways of updating the system in a secure manner,” he said.

2. Identify Risks

Know the specific threats you are facing: “The risks associated with connected vehicles are different to those facing a smart grid," Sys said. Know what your organization’s risk exposure is, plan for compromises, and have a clear idea of what to do when that happens.

The most common IoT vulnerabilities include web interface authentication and authorization, lack of transport encryption security, insufficient security configurability, and poor physical controls, Miessler says. Enterprises need to be aware of such risks and review the components of their IoT environment to identify and eliminate them, he notes.

3. Segment Networks

Because security errors tend to get magnified in an IoT environment, organizations need to keep their IT networks properly segmented from the IoT to prevent a security issue in one part of the network enabling or leading to problems in other parts of the network, Miessler said.

An organization that deploys an enterprise system to manage an industrial control system for instance has to manage two separate sets of security issues while keeping the two environments properly segmented.

4. Have a layered security system

Traditional IT security controls such as firewalls, intrusion detection systems, and anti-virus tools, will not be enough to protect IoT assets, Sys said. Even the user experience may not be a human experience. “If security measures such as passwords require human involvement, the system will either be inefficient or avoided entirely,” he said.

In addition, many IoT components are not equipped to deal with security issues and have minimal support for security patches and software updates, Miessler said. Often the patches themselves are easily compromised and can be used to deliver malware instead.

Dealing with such issues will require companies to deploy multi-layered controls for mitigating threats.

5. Be prepared to share security responsibility

Miessler expects IoT security to “absolutely be a shared jurisdiction” in which IT groups will need to coordinate security efforts with physical security teams and device manufacturers. Where manufactures are reluctant to take on the responsibility for integrating better security, organizations will need to put pressure on them to do so, he said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Risk, Privacy, and Information Security Officer, AvePoint, Inc.,  8/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-17305
PUBLISHED: 2018-08-21
Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a Bleichenbacher Oracle vulnerability in the IPSEC IKEv1 implementations. Remote attackers can decrypt IPSEC tunnel ciphertext data by leveraging a Bleichenbacher R...
CVE-2017-17311
PUBLISHED: 2018-08-21
Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted...
CVE-2017-17312
PUBLISHED: 2018-08-21
Some Huawei Firewall products USG2205BSR V300R001C10SPC600; USG2220BSR V300R001C00; USG5120BSR V300R001C00; USG5150BSR V300R001C00 have a DoS vulnerability in the IPSEC IKEv1 implementations of Huawei Firewall products. Due to improper handling of the malformed messages, an attacker may sent crafted...
CVE-2018-12115
PUBLISHED: 2018-08-21
In all versions of Node.js prior to 6.14.4, 8.11.4 and 10.9.0 when used with UCS-2 encoding (recognized by Node.js under the names `'ucs2'`, `'ucs-2'`, `'utf16le'` and `'utf-16le'`), `Buffer#write()` can be abused to write outside of the bounds of a single `Buffer`. Writes that start from the second...
CVE-2018-7166
PUBLISHED: 2018-08-21
In all versions of Node.js 10 prior to 10.9.0, an argument processing flaw can cause `Buffer.alloc()` to return uninitialized memory. This method is intended to be safe and only return initialized, or cleared, memory. The third argument specifying `encoding` can be passed as a number, this is misint...