Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/12/2019
10:00 AM
Prabhuram Mohan
Prabhuram Mohan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

6 Security Considerations for Wrangling IoT

The Internet of Things isn't going away, so it's important to be aware of the technology's potential pitfalls.

The year 2020 is fast approaching, and studies estimate that more than 10 billion Internet of Things (IoT) devices will be connected by then. As the number of devices continues to grow, we're putting ourselves at greater security risk. But despite the vulnerabilities, the general public keeps using and purchasing new devices and has come to have blind trust in them.

According to SAM Seamless Networks, security cameras make up nearly half of the most vulnerable devices, followed by smart home devices Google Home and Amazon Alexa. And vulnerabilities are not just in our homes — the enterprise is at risk also.

The Mirai botnet attacks are still being used to damage corporate networks. Recently, a new IoT bricking worm, malware dubbed Silex, has been hitting Linux-based devices, and it's designed to permanently disable the hardware it infects, effectively rendering the devices useless.

What Makes IoT So Vulnerable?
The sheer increase in the volume of consumer IoT fostered by retail and tech giants has created a massive attack surface. Consumers may have dozens of IoT devices in their homes. And with all of their variations in software, suppliers, and connection points, the possibilities for things to go wrong seem endless.

For instance, the simple task of turning on your home security system (an IoT device that communicates with a server), driving your car (your phone or car could also be an IoT device), and using a streaming camera at home seems innocuous on their own, but the data may be tracked by various parties, and combining them causes alarming possibilities of potential malicious activity.

To better ensure safety and security, education is needed across the entire IoT ecosystem — from consumers to device manufacturers, service providers, third parties, and developers. Findings show the top reasons for IoT security vulnerabilities include weak passwords, insecure web APIs, cloud and mobile interfaces, insecure third parties, network services, and data transfer to name a few.

What Can Be Done?
Security is only as strong as your weakest link, and we all need to be a bit paranoid in order to get better and for changes to take place. Below are a few considerations to build stronger IoT security:

1. Team mindset: For security to become a priority, it helps to have an entire team that is invested in security. This includes everyone from the CEO and website manager to the developer. When teams and priorities are aligned, budgets and actions are built into short- and long-term goals.

2. Standardization: IoT industry standardization is needed across the board — much like the standards for browsers and websites in the early days of the Internet. Web browsers and websites have evolved a lot over the years, and we are very much in the early stages of IoT.

3. Secure the supply chain: We must hold vendors accountable, but it's not just about the device itself — supply chain partners are numerous. As we saw with Google Home Nest cameras, third-party service providers were part of the problem that allowed old owners of cameras to spy on new owners.

4. Consumer education: If more people are educated on what could go wrong, they will be more security conscious. If they're aware of vulnerabilities and issues, they can help prevent attacks. For example, as we saw with the Nest vulnerability, they can make sure their devices are set to factory settings and check for updates to systems on a frequent basis. Educating kids at an early age can also go a long way, just like they're told to not open the door to strangers. In our modern age, "safety" is still the issue, but the risks have changed. The simple task of installing an application off the Web itself can become the weakest link.

5. Secure applications that support IoT devices: We must ensure that the code and software we build for IoT is continually tested for vulnerabilities. For instance, we can pre-emptively change default passwords of devices, and also manage the patch level of the kernel software on devices to prevent exploitation of new vulnerabilities.

6. Multilayered network security: Many things can be done at the enterprise network level. Segmentation of networks can ensure that hacked IoT devices can't affect other areas of networks. Perimeter security can help ensure hackers can't see networks in the first place. Companies should also limit the ability of IoT devices to initiate network connections.

IoT is certainly the Wild West in technology right now, but if we recognize IoT is not going away, and acknowledge its vulnerabilities do create real life safety issues for us, we can raise the awareness, work together across the different layers, and take steps to secure them.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Prabhu Mohan is a software development leader and innovator with over 20 years of product development and execution expertise covering a wide range of technologies and industry verticals spanning from application security and embedded mobile applications used on millions of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19698
PUBLISHED: 2019-12-10
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.