Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/30/2020
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How to Secure Your IoT Ecosystem in the Age of 5G

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface.

The Internet of Things is becoming an integral part of business and daily life, affecting everything from monitoring products in a warehouse to tracking your heartrate and sleeping patterns. Gartner predicts that by the end of this year, 5.8 billion enterprise and automotive IoT endpoints will be in use. And now, with deployment of 5G on the horizon and the massive expansion of IoT devices, a new security challenge is emerging.

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface. In a recent study by AT&T Cybersecurity, 44% of respondents stated this was their top business concern when it comes to 5G, while 39% identified the increase in connected devices to the network as their top concern. The number of connection points to the network, human and machine, will create new opportunities for bad actors to weaponize currently known manageable threats. 

While 5G is inherently more secure with its built-in security measures (including network slicing, stronger over-the-air encryption, subscriber identity protection, and reduced risk of eavesdropping) to address many business needs, enterprises should be proactive in adjusting their security policies and controls. Here are four tips for organizations to keep their networks safe in this new 5G connected world.

Adopt virtualized, automated security controls 
This will help organizations manage the expanded attack surface and mitigate future risk. Virtualized security can be deployed quickly and allows organizations to respond immediately to new attacks with an automated response such as creating a firewall. 

Implement machine learning and threat detection
You're going to need to be able to better monitor and analyze the increased amount of activity across your network. Machine learning and automated threat detection are necessary, since manual intervention will no longer be able to sift through and react to the amount of data 5G will bring.

Consider a zero-trust approach
Using zero trust for identity and authorization across all devices in your organization lowers the possibility of the introduction of malware on the network. By continually checking a user’s presence and behavior, a zero-trust model will help your security team quickly determine whether the user is human or machine.

Embrace a shared security model
IoT devices will continue to have vulnerabilities, such as factory-default passwords remaining in production, and organizations will need to take responsibility for safeguarding against rogue devices. Just as in the public cloud, a shared security model for 5G will help providers allow for security in the infrastructure by using the network itself as a security tool, while organizations tackle the endpoints.

In a shared security model, the enterprise would assume responsibility for devices on the network. And, with 5G, the network operator is responsible for the elements of security listed out in 3GPP frameworks and standards (i.e. data encryption and radio access network) as well as  handling the security of the network infrastructure itself, while the enterprise would assume responsibility for devices on the network including mobile device management, certification of applications that the enterprise runs on the network, and identity and access management.

With the influx of devices connected to 5G, adopting a holistic, multi-layered approach will be key to helping protect your IoT ecosystem and other valuable assets. Every organization’s IT and security infrastructure has a different design, which also means each organization’s security needs will differ. A factory floor, for example, that uses a number of industrial IoT devices to produce automobiles will have different security measures than a life-sensitive device, like an insulin pump, that is dependent on remediation and response plans. Even if someone is accessing the data, the device would not want to be disabled.

While there are controls to help prevent end devices from infecting carrier 4G networks, a single device has been known to impact enterprise networks. In 2018, hackers used a smart fish tank in a Las Vegas casino to access and move laterally throughout the network to steal 10 gigabytes of data. Anything that's connected can be a weak link for hackers to gain entry to your network. Take a step back to look at how your IoT networks are connected to your traditional IT networks to determine how to segment them. This will help limit risks in an organization’s IoT ecosystem. 

5G is coming, and along with it is a stream of IoT devices and new technologies. But organizations must keep in mind that this means the attack surface is also going to expand significantly and increase opportunities for bad actors. Adopting a multi-layered approach, identifying the interconnectivity of devices and its physical environment, as well as deploying virtualization and automation among other defenses, will help to lessen risk and prepare organizations for the promises of IoT in a 5G world.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Top story: "7 Steps to IoT Security in 2020."

Theresa Lanowitz is a proven global influencer and speaks around the world on trends and emerging technology poised to help today's IT organizations flourish. Prior to joining AT&T Cybersecurity, she founded industry analyst firm voke, to highlight emerging technologies and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity Industry: It's Time to Stop the Victim Blame Game
Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
Google Adds More Security Features Via Chronicle Division
Robert Lemos, Contributing Writer,  2/25/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9431
PUBLISHED: 2020-02-27
In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
CVE-2020-9432
PUBLISHED: 2020-02-27
openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-9433
PUBLISHED: 2020-02-27
openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-9434
PUBLISHED: 2020-02-27
openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
CVE-2020-6383
PUBLISHED: 2020-02-27
Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.