Endpoint

4/14/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

6 IoT Security Dangers To The Enterprise

Security risks arise as enterprises begin to deploy Internet of Things devices for the business and as employees bring those devices onto the corporate network.

As the Internet of Things (IoT) gradually becomes part of the business function, organizations must remain vigilant about securing these new potential targets.

While some industries are just beginning to introduce IoT into their businesses, the industrial sector -- such as power companies, for example -- have been utilizing IoT for some time now. “They’re the IoT hipster,” says Dave Lewis, global security advocate at Akamai. It’s imperative that their data is accurate and their systems remain up and running, so they need to ensure that their IoT devices remain secure. “If there is blizzard, you do have to worry about a loss of life," says Lewis, were the power systems to fail.

As other sectors implement IoT, Lewis warns against succumbing to the IoT of everything. Internet-connected toaster, anyone?

David Lewis, Akamai
David Lewis, Akamai

“IoT is the new bacon,” says Lewis, who will discuss IoT in the Securing the Internet of Broken Things session at Interop Las Vegas next month. Enterprise employees, IT departments, and office managers, should first pause and ask themselves: "Do I really need to plug this in?" before connecting different IoT devices to the network. More devices equal more endpoints to secure.

Organizations that already have a weak infrastructure must remain extra cautious, Lewis says. “As security debt builds up, adding IoT devices into the enterprise expands the attack surface.” 

Here's a look at six of the biggest threats IoT devices can bring to the enterprise: 

1.     Domain Name System (DNS) attacks to enterprise infrastructure 

DNS attacks to the enterprise infrastructure can cause DNS poisoning and hijacking. Enterprises need to pay special attention to these threats as they add IoT devices to the network.

Say you have a company called Widget Co., says Lewis, and Widget Co. has an IoT device. An attacker can render that device useless through a DNS attack. If the device that goes down is a product like Revolv, a smart hub recently purchased by Google that allows you to sync up your smart home devices, you’re going to have a nasty ripple effect on your hands, he notes. 

In order to prevent cybercriminals from using IoT devices to launch DNS attacks, enterprises need to properly maintain and patch their servers and invest in DNS infrastructure that can scale in the face of an increased traffic load, says Lewis.   

2.     Employees bring IoT devices into the network 

It’s possible to secure enterprise IoT, but what about all of those connected devices that employees are tinkering away at on the network, aka the "BYOIoT?"

Fitbits, smartwatches, and other IoT devices have already made their way onto the enterprise network scene, and making sure the network doesn’t go down and confidential data isn’t leaked due to a compromised connected device is something enterprises also need to think about. 

The age of restricted device usage is over. “Anything that is deployed, you have to be able to manage it,” says Lewis. But at the same time, you don’t [have} users just plugging anything into the network: organizations should deploy WiFi networks that are separate and specifically for employee devices and guest use. 

“The data is the perimeter,” says Lewis. Give employees the connectivity they want while protecting the organization, he says.

3.     Exposed APIs 

Exposed application programming interfaces (APIs) are a very serious threat to an enterprise utilizing IoT. If an organization has undocumented features of their API, or if someone is rolling out an API and they don’t have it properly documented or controlled, people will take advantage, says Lewis, adding that it’s “just one more avenue for an attacker to cause mischief.” 

When it comes to writing APIs, enterprises need to have checks and balances in place to ensure that they’re not opening themselves up to threats. 

4.     Device software gives itself too many permissions 

Organizations need to be diligent about carefully reviewing both the IoT software they’re creating and deploying on their networks. 

It’s possible that IoT software is giving itself too many permissions, says Lewis, leaving it open for attackers to leverage, or worse automate it. “This could lead to escalated access within an enterprise, data breaches, and so forth,” he warns. 

“People can/do install the software on their work systems,” Lewis says. And the software used by exercise tracking devices that you wear on your wrist to monitor your progress often has the same level of security that the IoT device has, which could be too little for the enterprise.

Devise a solid strategy for managing laptops and other devices on which software can be installed and figure out whether or not you want users to be able to install their own applications on these systems. 

5.     An influx in the volume of data 

When enterprises invest in IoT, it often comes with a sudden influx in data being collected and produced. Before deploying IoT devices, consider this: Can the network handle the volume of data they will produce, where will you store the data, and "are you going to end up in denial of service because of your own success?” says Lewis. 

Don’t get stuck cleaning up the data influx mess after it’s happened. Plan for scale, says Lewis, and be able to address future storage needs. 

6.     Legality of storing IoT data 

Then there's the question of whether you're legally allowed to store that data you’ve just created. “Germany has very strict privacy laws … that other countries don’t,” for example, says Lewis. So it’s important to take into account who you’re gathering data from, where they are, and if it’s legal to store that information. 

If you’re in the healthcare industry and you have an IoT device to manage your patients, “that data is very much subject to privacy regulations,” he says. 

Enterprises need to work with their legal departments to ensure that the data that they’re storing is not running afoul of data retention laws in the jurisdictions in which they operate, says Lewis.

Related Content:

 

 

Gain insight into the latest threats and emerging best practices for managing them. Attend the Security Track at Interop Las Vegas, May 2-6. Register now!

 

Emily Johnson is the digital content editor for InformationWeek. Prior to this role, Emily worked within UBM America's technology group as an associate editor on their content marketing team. Emily started her career at UBM in 2011 and spent four and a half years in content ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Cisco Talos Summit: Network Defenders Not Serious Enough About Attacks
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2018
Four Faces of Fraud: Identity, 'Fake' Identity, Ransomware & Digital
David Shefter, Chief Technology Officer at Ziften Technologies,  6/14/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-8030
PUBLISHED: 2018-06-20
A Denial of Service vulnerability was found in Apache Qpid Broker-J versions 7.0.0-7.0.4 when AMQP protocols 0-8, 0-9 or 0-91 are used to publish messages with size greater than allowed maximum message size limit (100MB by default). The broker crashes due to the defect. AMQP protocols 0-10 and 1.0 a...
CVE-2018-1117
PUBLISHED: 2018-06-20
ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this cou...
CVE-2018-11701
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x005cb509, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.
CVE-2018-11702
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00578cb3, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.
CVE-2018-11703
PUBLISHED: 2018-06-20
FastStone Image Viewer 6.2 has a User Mode Write AV at 0x00402d6a, triggered when the user opens a malformed JPEG file that is mishandled by FSViewer.exe. Attackers could exploit this issue for DoS (Access Violation) or possibly unspecified other impact.