Endpoint

4/14/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

6 IoT Security Dangers To The Enterprise

Security risks arise as enterprises begin to deploy Internet of Things devices for the business and as employees bring those devices onto the corporate network.

As the Internet of Things (IoT) gradually becomes part of the business function, organizations must remain vigilant about securing these new potential targets.

While some industries are just beginning to introduce IoT into their businesses, the industrial sector -- such as power companies, for example -- have been utilizing IoT for some time now. “They’re the IoT hipster,” says Dave Lewis, global security advocate at Akamai. It’s imperative that their data is accurate and their systems remain up and running, so they need to ensure that their IoT devices remain secure. “If there is blizzard, you do have to worry about a loss of life," says Lewis, were the power systems to fail.

As other sectors implement IoT, Lewis warns against succumbing to the IoT of everything. Internet-connected toaster, anyone?

David Lewis, Akamai
David Lewis, Akamai

“IoT is the new bacon,” says Lewis, who will discuss IoT in the Securing the Internet of Broken Things session at Interop Las Vegas next month. Enterprise employees, IT departments, and office managers, should first pause and ask themselves: "Do I really need to plug this in?" before connecting different IoT devices to the network. More devices equal more endpoints to secure.

Organizations that already have a weak infrastructure must remain extra cautious, Lewis says. “As security debt builds up, adding IoT devices into the enterprise expands the attack surface.” 

Here's a look at six of the biggest threats IoT devices can bring to the enterprise: 

1.     Domain Name System (DNS) attacks to enterprise infrastructure 

DNS attacks to the enterprise infrastructure can cause DNS poisoning and hijacking. Enterprises need to pay special attention to these threats as they add IoT devices to the network.

Say you have a company called Widget Co., says Lewis, and Widget Co. has an IoT device. An attacker can render that device useless through a DNS attack. If the device that goes down is a product like Revolv, a smart hub recently purchased by Google that allows you to sync up your smart home devices, you’re going to have a nasty ripple effect on your hands, he notes. 

In order to prevent cybercriminals from using IoT devices to launch DNS attacks, enterprises need to properly maintain and patch their servers and invest in DNS infrastructure that can scale in the face of an increased traffic load, says Lewis.   

2.     Employees bring IoT devices into the network 

It’s possible to secure enterprise IoT, but what about all of those connected devices that employees are tinkering away at on the network, aka the "BYOIoT?"

Fitbits, smartwatches, and other IoT devices have already made their way onto the enterprise network scene, and making sure the network doesn’t go down and confidential data isn’t leaked due to a compromised connected device is something enterprises also need to think about. 

The age of restricted device usage is over. “Anything that is deployed, you have to be able to manage it,” says Lewis. But at the same time, you don’t [have} users just plugging anything into the network: organizations should deploy WiFi networks that are separate and specifically for employee devices and guest use. 

“The data is the perimeter,” says Lewis. Give employees the connectivity they want while protecting the organization, he says.

3.     Exposed APIs 

Exposed application programming interfaces (APIs) are a very serious threat to an enterprise utilizing IoT. If an organization has undocumented features of their API, or if someone is rolling out an API and they don’t have it properly documented or controlled, people will take advantage, says Lewis, adding that it’s “just one more avenue for an attacker to cause mischief.” 

When it comes to writing APIs, enterprises need to have checks and balances in place to ensure that they’re not opening themselves up to threats. 

4.     Device software gives itself too many permissions 

Organizations need to be diligent about carefully reviewing both the IoT software they’re creating and deploying on their networks. 

It’s possible that IoT software is giving itself too many permissions, says Lewis, leaving it open for attackers to leverage, or worse automate it. “This could lead to escalated access within an enterprise, data breaches, and so forth,” he warns. 

“People can/do install the software on their work systems,” Lewis says. And the software used by exercise tracking devices that you wear on your wrist to monitor your progress often has the same level of security that the IoT device has, which could be too little for the enterprise.

Devise a solid strategy for managing laptops and other devices on which software can be installed and figure out whether or not you want users to be able to install their own applications on these systems. 

5.     An influx in the volume of data 

When enterprises invest in IoT, it often comes with a sudden influx in data being collected and produced. Before deploying IoT devices, consider this: Can the network handle the volume of data they will produce, where will you store the data, and "are you going to end up in denial of service because of your own success?” says Lewis. 

Don’t get stuck cleaning up the data influx mess after it’s happened. Plan for scale, says Lewis, and be able to address future storage needs. 

6.     Legality of storing IoT data 

Then there's the question of whether you're legally allowed to store that data you’ve just created. “Germany has very strict privacy laws … that other countries don’t,” for example, says Lewis. So it’s important to take into account who you’re gathering data from, where they are, and if it’s legal to store that information. 

If you’re in the healthcare industry and you have an IoT device to manage your patients, “that data is very much subject to privacy regulations,” he says. 

Enterprises need to work with their legal departments to ensure that the data that they’re storing is not running afoul of data retention laws in the jurisdictions in which they operate, says Lewis.

Related Content:

 

 

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
Dark Reading Live EVENTS
INsecurity - For the Defenders of Enterprise Security
A Dark Reading Conference
While red team conferences focus primarily on new vulnerabilities and security researchers, INsecurity puts security execution, protection, and operations center stage. The primary speakers will be CISOs and leaders in security defense; the blue team will be the focus.
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: No, no, no! Have a Unix CRON do the pop-up reminders!
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.