Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/14/2018
10:30 AM
Charlie Miller
Charlie Miller
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Why Enterprises Can't Ignore Third-Party IoT-Related Risks

There's a major disconnect between Internet of Things governance and risk management, according to a new report. Follow these five steps to address the risks.

The Internet of Things (IoT) is one of the greatest technological advancements in the last decade, so it's no wonder that the IoT market is expected to grow to 20.4 billion devices by 2020 and more than 8.4 billion IoT devices are already in use today.

According to a new report by the Ponemon Institute and Shared Assessments, "The Internet of Things (IoT): A New Era of Third Party Risk," it is estimated that every workplace has approximately 16,000 IoT devices connected to its network. Given the prevalence of IoT adoption, it makes sense that IoT presents a major threat vector for hackers who have discovered new entry points for cyberattacks. Basically, any device with an Internet connection is subject to being compromised and can become a back door for attackers to access enterprises or steal other sensitive data.

Unfortunately, many IoT devices run on firmware that is often difficult to patch and update, and some come with default passwords that are easy to crack. We've already seen plenty of distributed denial-of-service (DDoS) attacks through IoT devices, including the Mirai botnet and Brickerbot, IoT ransomware, malware, and more. Over the past two years, baby monitors, robots, smart TVs and refrigerators, Nest thermostats, and even connected cars have made headlines for being hacked.

Many enterprises are finally realizing the growing attack surface that IoT devices bring to the workplace, and some are beginning to monitor for these endpoints. But what happens when an IoT device that's connected to a corporate network by a third party suddenly becomes compromised? Is that enterprise monitoring its third parties for IoT risks? Is there a policy in place to handle risky third-party IoT devices? According to this new research, many enterprises are ill prepared for this uphill IoT risk management battle.

Shared Assessments commissioned Ponemon to survey 605 individuals who participate in corporate governance and/or risk oversight activities and are familiar with the use of IoT devices in their organization. The study found that while there have been some advances in third-party risk focused on IoT devices and applications since 2017, risk management in this area is still at a relatively low level of maturity. It revealed that almost all respondents (97%) believe their organization will suffer from a catastrophic IoT-related security event in the next two years, yet many aren't properly assessing for third-party IoT risks and many don't have an accurate inventory of IoT devices or applications.

The report underscores three major disconnects when it comes to third-party risk management practices, including:

The awareness of IoT risks is increasing as IoT adoption grows: With an increasing reliance on IoT devices in the workplace, organizations are realizing the magnitude of what an attack related to an unsecured IoT device could do to their business. Eighty-one percent of survey respondents say that a data breach caused by an unsecured IoT device is likely to occur in the next 24 months, and 60% are concerned the IoT ecosystem is vulnerable to a ransomware attack. However, only 28% say they currently include IoT-related risk as part of the third-party due diligence.

IoT risk management practices are uneven: The average number of IoT devices in the workplace is expected to grow from 15,875 to 24,762 over the next two years, so it's not surprising that only 45% of respondents believe it's possible to keep an inventory of such devices, while only 19% inventory at least 50% of their IoT devices. A large majority, 88%, cite lack of centralized control as a primary reason for the difficulty of completing and maintaining a full inventory. Even though 60% of respondents say their organization has a third-party risk management program in place, less than half of organizations (46%) say they have a policy in place to disable a risky IoT device within their own organization.

The gap between internal and third-party IoT monitoring is substantial: Almost half of all organizations say they are actively monitoring for IoT device risks within their workplace, but more concerning is that only 29% are actively monitoring for third-party IoT device risks. A quarter of respondents admit they are unsure if their organization was affected by a cyberattack involving an IoT device, while 35% said they don't know if it would be possible to detect a third-party data breach. Shockingly, only 9% of respondents say they are fully aware of all of their physical objects connected to the Internet.

The bottom line is that more focus is being given to internal workplace IoT device risks than to risks posed by third parties. Many companies have fallen behind on the basics such as assigning accountability and inventory management, and there are uncertainties around who is responsible for managing and mitigating third-party risks. There's also an over-reliance on third-party contracts and policies for IoT risk management.

To more effectively address IoT risks and improve third-party risk management programs, companies should take the following proactive steps:

  1. Update asset management processes and inventory systems to include IoT devices and applications, and understand the security characteristics of all inventoried devices. When devices are found to have inadequate IoT security controls, replace them.
  2. Identify and assign accountability for approval, monitoring, use, and deployment of IoT devices and applications within your organization.
  3. Ensure that IoT devices, applications and metrics are included, monitored, and reported as part of your third-party risk management program.
  4. Verify that specific third-party IoT related controls included in contract clauses, policies, and procedures can be operationalized and monitored for adherence and compliance.
  5. Collaborate with industry peers, colleagues, and experts to identify successful approaches, techniques, solutions, and standards to monitor and mitigate third-party IoT device and application risks.

Related Content:

Charlie Miller is senior vice president with the Santa Fe Group where his key responsibilities include managing and expanding the Collaborative Onsite Assessments Program and facilitating regulatory, partner and association relationships. Charlie has vast industry experience, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AmeliaWinter
50%
50%
AmeliaWinter,
User Rank: Apprentice
5/20/2018 | 12:17:43 PM
Re: Iot Threats
Appreciate the comment. The 2% refers to "observed exploitation events" related to those vulnerabilities. It appears that you're referring to "has an exploit published." (additional background can be found in the Data Sources section of the full report)
Mike_James
50%
50%
Mike_James,
User Rank: Apprentice
5/15/2018 | 10:40:35 AM
Iot Threats
Great post Charlie, and certainly an area of concern for enterprises of all sizes. There clearly aren't enough protocols in place for security breaches at this early stage, when so many devices and everyday tools are connected. Staff sign-in badges, building elevators and so much more are now online - and no doubt require great risk assessment. Encyrption will become essential for any connected device, and maybe ethical hacking / penetration testing... which begs the question; is it worth connecting them in the first place, when the potential loss through breach far outweighs the marginal gains? 
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4811
PUBLISHED: 2021-05-14
IBM Cloud Pak for Security (CP4S) 1.4.0.0, 1.5.0.0, 1.5.0.1, 1.6.0.0, and 1.6.0.1 could allow a privileged user to inject inject malicious data using a specially crafted HTTP request due to improper input validation.
CVE-2020-4985
PUBLISHED: 2021-05-14
IBM Planning Analytics Local 2.0 could allow an attacker to obtain sensitive information due to accepting body parameters in a query. IBM X-Force ID: 192642.
CVE-2021-20391
PUBLISHED: 2021-05-14
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 195999.
CVE-2021-20392
PUBLISHED: 2021-05-14
IBM QRadar User Behavior Analytics 1.0.0 through 4.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2021-20393
PUBLISHED: 2021-05-14
IBM QRadar User Behavior Analytics 1.0.0 through 4.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 196001.