Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

1/4/2018
10:30 AM
Rinki Sethi
Rinki Sethi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

The Internet of (Secure) Things Checklist

Insecure devices put your company at jeopardy. Use this checklist to stay safer.

In October 2016, as a botnet strung together by the Mirai malware launched the biggest distributed denial-of-service attack in history, I was, appropriately enough, giving a talk on Internet of Things (IoT) security and privacy at the Grace Hopper Conference. As I learned of the attack, and as questions came in from the audience about the malware, I knew that the topic of my session could not have been more timely. In this instance, and in countless others, IoT security is a core issue. Security professionals need to be concerned about insecure devices.

More than a year later, IoT continues to be a growing concern. From Internet-connected toaster ovens to smart hairbrushes to popular health trackers, these devices can be risky, especially when used in certain environments. Given the prevalence of these devices coming in and out of corporate networks, not only is it important to be ready to protect your own organization, but it is crucial to understand how far IoT risk can extend. 

As the AT&T IoT Cybersecurity Alliance highlighted in a recent white paper, Mirai was a prime example of the type of risk posed by unsecured IoT devices. The obvious threat is exposure of personal data to an attacker who compromises a device. However, according to the report, if the connected devices within your organization are used as part of a widespread attack, your organization could suffer reputational damage or, worse, your organization could be victimized by a compromised IoT device from a business partner.

Just like any type of cyberattack, the implications of an IoT attack are far-reaching. This is why it is important for security professionals to approach IoT security just as they would network, endpoint, and cloud security. A comprehensive cyber hygiene strategy is a necessary component of securing your organization and preventing cyber attacks.

Security teams should review their current priorities and reference this basic IoT security hygiene checklist:

  1. Assess your company's overall risk acceptance. Every company has a different view of the types of risks they are willing to accept, and it's critical you understand your company's overall risk acceptance. This is an important first step, as it will help you determine which devices you will allow to connect and which devices you will need to block. For example, some companies may find it to be low-risk if users connect health-tracking devices to company laptops, allowing them to transfer personal health data. Other companies with a different security posture may find this to be a high risk.
  2. Develop an IoT awareness and training program.  Employees need to be aware of the risk that connected devices present. In order for them to be IoT savvy, they need proper resources and training. An integral part of developing their awareness is making sure they understand how their personal devices are part of the bigger picture and overall security of their workplace — and what is allowed and what is not. Training also should include how to do IoT health checks to determine if devices are secure. It is important to provide employees with the tools needed to protect themselves and the organization, whether that means a required course on IoT risk and cyber hygiene or a video starring the executive staff that demonstrates possible IoT threat scenarios.
  3. Practice what you preach. A personal device hygiene check is always a good reminder about the importance of IoT security. Going through this process yourself will help you figure out what should be included in your company's IoT hygiene program. I make a habit of regularly checking through the apps on my phone to see what access they have. Many devices request access to photos, location information, and contacts; ask yourself if you want to allow this. Keeping IoT devices up to date and ensuring the proper privacy settings are in place are important steps for securing your own device and for securing the networks and other devices that they connect to, including company laptops and mobile phones.

Gartner predicts that more than 20 billion connected devices will be in operation by 2020, rising from 8.4 billion in 2017. The security investments made by companies creating these billions of devices are just as diverse as the devices themselves. There are some IoT companies investing in a lot in security, while others are focusing only on creating connected devices — and security may be an afterthought. As security practitioners, we should take this into consideration when assessing IoT risk for our organizations and users. There is a lot we can do to ensure we are one step ahead when it comes to IoT security.

Related Content:

Rinki Sethi is Senior Director of Security Operations and Strategy at Palo Alto Networks. She is responsible for building a world-class security operations center that includes capabilities such as threat management, security monitoring, and threat intelligence. Rinki is also ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lee337w
50%
50%
lee337w,
User Rank: Apprentice
1/5/2018 | 4:31:06 PM
New Devices, same rules
Great post on how the same security hygiene techniques will help combat the IoT security challenges. Many people think compeltely new paradigms are needed, but it really comes down to tried and true practices and controls to help create and maintain secure environments. Great Article
mrgorle@yahoo.com
50%
50%
[email protected],
User Rank: Apprentice
1/5/2018 | 2:53:51 PM
Very informative and detailed
This is very informative and detailed article. Thanks.
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17545
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2019-17546
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-17547
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVE-2019-17501
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
CVE-2019-17539
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.