Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

2/24/2015
08:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

5 Ways To Prepare For IoT Security Risks

As the Internet of Things begins to take shape, IT organizations must prepare for change.

Enterprises can expect to see some fundamental changes in the information security and data privacy landscape as the Internet of Things (IoT) begins to take shape over the next several years.

The sheer diversity of IoT assets and the myriad ways in which they connect with each other and the enterprise network will raise new IT governance and cybersecurity challenges, Verizon said in a status report on the IoT market this week. Dealing with the changes will require a new way of thinking about IT security and management, the report noted.

“Because IoT is all about physical “things,” hackers that gain access can not just perform the usual digital attacks like stealing data, moving money, or shutting down websites,” Verizon said. They can also cause physical havoc by tampering with critical infrastructure like electric grids, SCADA systems, healthcare devices, and aviation systems.

For the most part, the Verizon report offers a review of how organizations in different industries have already begun deriving measurable business value from IoT projects. As examples, it points to transportation companies that are saving millions of dollars on fuel consumption by using IP-enabled devices to track and manage fleets, local governments stretching their budget dollars via smart street lighting projects and utilities improving operations via smart meters.

Organizations across sectors are harnessing IoT technologies to increase revenues, improve operational efficiencies and find new ways to do thing, Verizon noted.

But the trend also presents new challenges, Verizon noted. Every Internet-enabled sensor and device in an IT environment presents a potential security risk. Verizon pointed to a 2014 report by Hewlett-Packard showing 70 percent of the most commonly used IoT devices, such as smart thermostats and home security systems, contain serious security vulnerabilities.

Even the most security-conscious organizations may be unprepared for the full security impact of a world in which tens of billons of devices and things are connected to the Internet, the report noted.

Johan Sys, managing principal of identity and access management at Verizon Enterprise Solutions, says as more things join the established Internet, they are likely to present the same kind of attack opportunities as the devices that first made up the Internet. “As long as there is value in the information exchanged by connected devices, there will be malicious actors who will attack the applications running on the network,” Sys said in emailed comments to Dark Reading. There are several measures that organizations can take to prepare for the risks, he said.

1. Bake security into IoT applications from the start

Because of its highly interconnected nature, the IoT amplifies the impact of security vulnerabilities, says Daniel Miessler, an HP security researcher involved in the 2014 IoT report. “We have broken network security, broken web security, broken cloud security,” he says. “What the IoT does is take all of these vulnerabilities and smash them together into one product. We should not be surprised there are issues,” Miessler says.

One of the first things developers of IoT applications should focus on, according to Sys, is building in security from the start. “This needs to include ways of updating the system in a secure manner,” he said.

2. Identify Risks

Know the specific threats you are facing: “The risks associated with connected vehicles are different to those facing a smart grid," Sys said. Know what your organization’s risk exposure is, plan for compromises, and have a clear idea of what to do when that happens.

The most common IoT vulnerabilities include web interface authentication and authorization, lack of transport encryption security, insufficient security configurability, and poor physical controls, Miessler says. Enterprises need to be aware of such risks and review the components of their IoT environment to identify and eliminate them, he notes.

3. Segment Networks

Because security errors tend to get magnified in an IoT environment, organizations need to keep their IT networks properly segmented from the IoT to prevent a security issue in one part of the network enabling or leading to problems in other parts of the network, Miessler said.

An organization that deploys an enterprise system to manage an industrial control system for instance has to manage two separate sets of security issues while keeping the two environments properly segmented.

4. Have a layered security system

Traditional IT security controls such as firewalls, intrusion detection systems, and anti-virus tools, will not be enough to protect IoT assets, Sys said. Even the user experience may not be a human experience. “If security measures such as passwords require human involvement, the system will either be inefficient or avoided entirely,” he said.

In addition, many IoT components are not equipped to deal with security issues and have minimal support for security patches and software updates, Miessler said. Often the patches themselves are easily compromised and can be used to deliver malware instead.

Dealing with such issues will require companies to deploy multi-layered controls for mitigating threats.

5. Be prepared to share security responsibility

Miessler expects IoT security to “absolutely be a shared jurisdiction” in which IT groups will need to coordinate security efforts with physical security teams and device manufacturers. Where manufactures are reluctant to take on the responsibility for integrating better security, organizations will need to put pressure on them to do so, he said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19604
PUBLISHED: 2019-12-11
Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before 2.23.1, and 2.24.x before 2.24.1 because a "git submodule update" operation can run commands found in the .gitmodules file of a malicious repository.
CVE-2019-14861
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default permiss...
CVE-2019-14870
PUBLISHED: 2019-12-10
All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the S4U (MS-SFU) Kerberos delegation model includes a feature allowing for a subset of clients to be opted out of constrained delegation in any way, either S4U2Self or regular Kerberos authent...
CVE-2019-14889
PUBLISHED: 2019-12-10
A flaw was found with the libssh API function ssh_scp_new() in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...
CVE-2019-1484
PUBLISHED: 2019-12-10
A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input, aka 'Windows OLE Remote Code Execution Vulnerability'.