Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/14/2018
10:30 AM
Charlie Miller
Charlie Miller
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

Why Enterprises Can't Ignore Third-Party IoT-Related Risks

There's a major disconnect between Internet of Things governance and risk management, according to a new report. Follow these five steps to address the risks.

The Internet of Things (IoT) is one of the greatest technological advancements in the last decade, so it's no wonder that the IoT market is expected to grow to 20.4 billion devices by 2020 and more than 8.4 billion IoT devices are already in use today.

According to a new report by the Ponemon Institute and Shared Assessments, "The Internet of Things (IoT): A New Era of Third Party Risk," it is estimated that every workplace has approximately 16,000 IoT devices connected to its network. Given the prevalence of IoT adoption, it makes sense that IoT presents a major threat vector for hackers who have discovered new entry points for cyberattacks. Basically, any device with an Internet connection is subject to being compromised and can become a back door for attackers to access enterprises or steal other sensitive data.

Unfortunately, many IoT devices run on firmware that is often difficult to patch and update, and some come with default passwords that are easy to crack. We've already seen plenty of distributed denial-of-service (DDoS) attacks through IoT devices, including the Mirai botnet and Brickerbot, IoT ransomware, malware, and more. Over the past two years, baby monitors, robots, smart TVs and refrigerators, Nest thermostats, and even connected cars have made headlines for being hacked.

Many enterprises are finally realizing the growing attack surface that IoT devices bring to the workplace, and some are beginning to monitor for these endpoints. But what happens when an IoT device that's connected to a corporate network by a third party suddenly becomes compromised? Is that enterprise monitoring its third parties for IoT risks? Is there a policy in place to handle risky third-party IoT devices? According to this new research, many enterprises are ill prepared for this uphill IoT risk management battle.

Shared Assessments commissioned Ponemon to survey 605 individuals who participate in corporate governance and/or risk oversight activities and are familiar with the use of IoT devices in their organization. The study found that while there have been some advances in third-party risk focused on IoT devices and applications since 2017, risk management in this area is still at a relatively low level of maturity. It revealed that almost all respondents (97%) believe their organization will suffer from a catastrophic IoT-related security event in the next two years, yet many aren't properly assessing for third-party IoT risks and many don't have an accurate inventory of IoT devices or applications.

The report underscores three major disconnects when it comes to third-party risk management practices, including:

The awareness of IoT risks is increasing as IoT adoption grows: With an increasing reliance on IoT devices in the workplace, organizations are realizing the magnitude of what an attack related to an unsecured IoT device could do to their business. Eighty-one percent of survey respondents say that a data breach caused by an unsecured IoT device is likely to occur in the next 24 months, and 60% are concerned the IoT ecosystem is vulnerable to a ransomware attack. However, only 28% say they currently include IoT-related risk as part of the third-party due diligence.

IoT risk management practices are uneven: The average number of IoT devices in the workplace is expected to grow from 15,875 to 24,762 over the next two years, so it's not surprising that only 45% of respondents believe it's possible to keep an inventory of such devices, while only 19% inventory at least 50% of their IoT devices. A large majority, 88%, cite lack of centralized control as a primary reason for the difficulty of completing and maintaining a full inventory. Even though 60% of respondents say their organization has a third-party risk management program in place, less than half of organizations (46%) say they have a policy in place to disable a risky IoT device within their own organization.

The gap between internal and third-party IoT monitoring is substantial: Almost half of all organizations say they are actively monitoring for IoT device risks within their workplace, but more concerning is that only 29% are actively monitoring for third-party IoT device risks. A quarter of respondents admit they are unsure if their organization was affected by a cyberattack involving an IoT device, while 35% said they don't know if it would be possible to detect a third-party data breach. Shockingly, only 9% of respondents say they are fully aware of all of their physical objects connected to the Internet.

The bottom line is that more focus is being given to internal workplace IoT device risks than to risks posed by third parties. Many companies have fallen behind on the basics such as assigning accountability and inventory management, and there are uncertainties around who is responsible for managing and mitigating third-party risks. There's also an over-reliance on third-party contracts and policies for IoT risk management.

To more effectively address IoT risks and improve third-party risk management programs, companies should take the following proactive steps:

  1. Update asset management processes and inventory systems to include IoT devices and applications, and understand the security characteristics of all inventoried devices. When devices are found to have inadequate IoT security controls, replace them.
  2. Identify and assign accountability for approval, monitoring, use, and deployment of IoT devices and applications within your organization.
  3. Ensure that IoT devices, applications and metrics are included, monitored, and reported as part of your third-party risk management program.
  4. Verify that specific third-party IoT related controls included in contract clauses, policies, and procedures can be operationalized and monitored for adherence and compliance.
  5. Collaborate with industry peers, colleagues, and experts to identify successful approaches, techniques, solutions, and standards to monitor and mitigate third-party IoT device and application risks.

Related Content:

Charlie Miller is senior vice president with the Santa Fe Group where his key responsibilities include managing and expanding the Collaborative Onsite Assessments Program and facilitating regulatory, partner and association relationships. Charlie has vast industry experience, ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Mike_James
50%
50%
Mike_James,
User Rank: Apprentice
5/15/2018 | 10:40:35 AM
Iot Threats
Great post Charlie, and certainly an area of concern for enterprises of all sizes. There clearly aren't enough protocols in place for security breaches at this early stage, when so many devices and everyday tools are connected. Staff sign-in badges, building elevators and so much more are now online - and no doubt require great risk assessment. Encyrption will become essential for any connected device, and maybe ethical hacking / penetration testing... which begs the question; is it worth connecting them in the first place, when the potential loss through breach far outweighs the marginal gains? 
AmeliaWinter
50%
50%
AmeliaWinter,
User Rank: Apprentice
5/20/2018 | 12:17:43 PM
Re: Iot Threats
Appreciate the comment. The 2% refers to "observed exploitation events" related to those vulnerabilities. It appears that you're referring to "has an exploit published." (additional background can be found in the Data Sources section of the full report)
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-12848
PUBLISHED: 2020-06-05
In Pydio Cells 2.0.4, once an authenticated user shares a file selecting the create a public link option, a hidden shared user account is created in the backend with a random username. An anonymous user that obtains a valid public link can get the associated hidden account username and password and ...
CVE-2020-12849
PUBLISHED: 2020-06-05
Pydio Cells 2.0.4 allows any user to upload a profile image to the web application, including standard and shared user roles. These profile pictures can later be accessed directly with the generated URL by any unauthenticated or authenticated user.
CVE-2020-13842
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). A dangerous AT command was made available even though it is unused. The LG ID is LVE-SMP-200010 (June 2020).
CVE-2020-13843
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS software before 2020-06-01. Local users can cause a denial of service because checking of the userdata partition is mishandled. The LG ID is LVE-SMP-200014 (June 2020).
CVE-2020-13839
PUBLISHED: 2020-06-05
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 (MTK chipsets). Code execution can occur via a custom AT command handler buffer overflow. The LG ID is LVE-SMP-200007 (June 2020).