Endpoint
4/14/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

6 IoT Security Dangers To The Enterprise

Security risks arise as enterprises begin to deploy Internet of Things devices for the business and as employees bring those devices onto the corporate network.

As the Internet of Things (IoT) gradually becomes part of the business function, organizations must remain vigilant about securing these new potential targets.

While some industries are just beginning to introduce IoT into their businesses, the industrial sector -- such as power companies, for example -- have been utilizing IoT for some time now. “They’re the IoT hipster,” says Dave Lewis, global security advocate at Akamai. It’s imperative that their data is accurate and their systems remain up and running, so they need to ensure that their IoT devices remain secure. “If there is blizzard, you do have to worry about a loss of life," says Lewis, were the power systems to fail.

As other sectors implement IoT, Lewis warns against succumbing to the IoT of everything. Internet-connected toaster, anyone?

David Lewis, Akamai
David Lewis, Akamai

“IoT is the new bacon,” says Lewis, who will discuss IoT in the Securing the Internet of Broken Things session at Interop Las Vegas next month. Enterprise employees, IT departments, and office managers, should first pause and ask themselves: "Do I really need to plug this in?" before connecting different IoT devices to the network. More devices equal more endpoints to secure.

Organizations that already have a weak infrastructure must remain extra cautious, Lewis says. “As security debt builds up, adding IoT devices into the enterprise expands the attack surface.” 

Here's a look at six of the biggest threats IoT devices can bring to the enterprise: 

1.     Domain Name System (DNS) attacks to enterprise infrastructure 

DNS attacks to the enterprise infrastructure can cause DNS poisoning and hijacking. Enterprises need to pay special attention to these threats as they add IoT devices to the network.

Say you have a company called Widget Co., says Lewis, and Widget Co. has an IoT device. An attacker can render that device useless through a DNS attack. If the device that goes down is a product like Revolv, a smart hub recently purchased by Google that allows you to sync up your smart home devices, you’re going to have a nasty ripple effect on your hands, he notes. 

In order to prevent cybercriminals from using IoT devices to launch DNS attacks, enterprises need to properly maintain and patch their servers and invest in DNS infrastructure that can scale in the face of an increased traffic load, says Lewis.   

2.     Employees bring IoT devices into the network 

It’s possible to secure enterprise IoT, but what about all of those connected devices that employees are tinkering away at on the network, aka the "BYOIoT?"

Fitbits, smartwatches, and other IoT devices have already made their way onto the enterprise network scene, and making sure the network doesn’t go down and confidential data isn’t leaked due to a compromised connected device is something enterprises also need to think about. 

The age of restricted device usage is over. “Anything that is deployed, you have to be able to manage it,” says Lewis. But at the same time, you don’t [have} users just plugging anything into the network: organizations should deploy WiFi networks that are separate and specifically for employee devices and guest use. 

“The data is the perimeter,” says Lewis. Give employees the connectivity they want while protecting the organization, he says.

3.     Exposed APIs 

Exposed application programming interfaces (APIs) are a very serious threat to an enterprise utilizing IoT. If an organization has undocumented features of their API, or if someone is rolling out an API and they don’t have it properly documented or controlled, people will take advantage, says Lewis, adding that it’s “just one more avenue for an attacker to cause mischief.” 

When it comes to writing APIs, enterprises need to have checks and balances in place to ensure that they’re not opening themselves up to threats. 

4.     Device software gives itself too many permissions 

Organizations need to be diligent about carefully reviewing both the IoT software they’re creating and deploying on their networks. 

It’s possible that IoT software is giving itself too many permissions, says Lewis, leaving it open for attackers to leverage, or worse automate it. “This could lead to escalated access within an enterprise, data breaches, and so forth,” he warns. 

“People can/do install the software on their work systems,” Lewis says. And the software used by exercise tracking devices that you wear on your wrist to monitor your progress often has the same level of security that the IoT device has, which could be too little for the enterprise.

Devise a solid strategy for managing laptops and other devices on which software can be installed and figure out whether or not you want users to be able to install their own applications on these systems. 

5.     An influx in the volume of data 

When enterprises invest in IoT, it often comes with a sudden influx in data being collected and produced. Before deploying IoT devices, consider this: Can the network handle the volume of data they will produce, where will you store the data, and "are you going to end up in denial of service because of your own success?” says Lewis. 

Don’t get stuck cleaning up the data influx mess after it’s happened. Plan for scale, says Lewis, and be able to address future storage needs. 

6.     Legality of storing IoT data 

Then there's the question of whether you're legally allowed to store that data you’ve just created. “Germany has very strict privacy laws … that other countries don’t,” for example, says Lewis. So it’s important to take into account who you’re gathering data from, where they are, and if it’s legal to store that information. 

If you’re in the healthcare industry and you have an IoT device to manage your patients, “that data is very much subject to privacy regulations,” he says. 

Enterprises need to work with their legal departments to ensure that the data that they’re storing is not running afoul of data retention laws in the jurisdictions in which they operate, says Lewis.

Related Content:

 

 

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Security Technologies to Watch in 2017
Emerging tools and services promise to make a difference this year. Are they on your company's list?
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.