Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/30/2020
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How to Secure Your IoT Ecosystem in the Age of 5G

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface.

The Internet of Things is becoming an integral part of business and daily life, affecting everything from monitoring products in a warehouse to tracking your heartrate and sleeping patterns. Gartner predicts that by the end of this year, 5.8 billion enterprise and automotive IoT endpoints will be in use. And now, with deployment of 5G on the horizon and the massive expansion of IoT devices, a new security challenge is emerging.

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface. In a recent study by AT&T Cybersecurity, 44% of respondents stated this was their top business concern when it comes to 5G, while 39% identified the increase in connected devices to the network as their top concern. The number of connection points to the network, human and machine, will create new opportunities for bad actors to weaponize currently known manageable threats. 

While 5G is inherently more secure with its built-in security measures (including network slicing, stronger over-the-air encryption, subscriber identity protection, and reduced risk of eavesdropping) to address many business needs, enterprises should be proactive in adjusting their security policies and controls. Here are four tips for organizations to keep their networks safe in this new 5G connected world.

Adopt virtualized, automated security controls 
This will help organizations manage the expanded attack surface and mitigate future risk. Virtualized security can be deployed quickly and allows organizations to respond immediately to new attacks with an automated response such as creating a firewall. 

Implement machine learning and threat detection
You're going to need to be able to better monitor and analyze the increased amount of activity across your network. Machine learning and automated threat detection are necessary, since manual intervention will no longer be able to sift through and react to the amount of data 5G will bring.

Consider a zero-trust approach
Using zero trust for identity and authorization across all devices in your organization lowers the possibility of the introduction of malware on the network. By continually checking a user’s presence and behavior, a zero-trust model will help your security team quickly determine whether the user is human or machine.

Embrace a shared security model
IoT devices will continue to have vulnerabilities, such as factory-default passwords remaining in production, and organizations will need to take responsibility for safeguarding against rogue devices. Just as in the public cloud, a shared security model for 5G will help providers allow for security in the infrastructure by using the network itself as a security tool, while organizations tackle the endpoints.

In a shared security model, the enterprise would assume responsibility for devices on the network. And, with 5G, the network operator is responsible for the elements of security listed out in 3GPP frameworks and standards (i.e. data encryption and radio access network) as well as  handling the security of the network infrastructure itself, while the enterprise would assume responsibility for devices on the network including mobile device management, certification of applications that the enterprise runs on the network, and identity and access management.

With the influx of devices connected to 5G, adopting a holistic, multi-layered approach will be key to helping protect your IoT ecosystem and other valuable assets. Every organization’s IT and security infrastructure has a different design, which also means each organization’s security needs will differ. A factory floor, for example, that uses a number of industrial IoT devices to produce automobiles will have different security measures than a life-sensitive device, like an insulin pump, that is dependent on remediation and response plans. Even if someone is accessing the data, the device would not want to be disabled.

While there are controls to help prevent end devices from infecting carrier 4G networks, a single device has been known to impact enterprise networks. In 2018, hackers used a smart fish tank in a Las Vegas casino to access and move laterally throughout the network to steal 10 gigabytes of data. Anything that's connected can be a weak link for hackers to gain entry to your network. Take a step back to look at how your IoT networks are connected to your traditional IT networks to determine how to segment them. This will help limit risks in an organization’s IoT ecosystem. 

5G is coming, and along with it is a stream of IoT devices and new technologies. But organizations must keep in mind that this means the attack surface is also going to expand significantly and increase opportunities for bad actors. Adopting a multi-layered approach, identifying the interconnectivity of devices and its physical environment, as well as deploying virtualization and automation among other defenses, will help to lessen risk and prepare organizations for the promises of IoT in a 5G world.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Top story: "7 Steps to IoT Security in 2020."

Theresa Lanowitz is a proven global influencer and speaks around the world on trends and emerging technology poised to help today's IT organizations flourish. Prior to joining AT&T Cybersecurity, she founded industry analyst firm voke, to highlight emerging technologies and ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
When It Comes To Security Tools, More Isn't More
Lamont Orange, Chief Information Security Officer at Netskope,  1/11/2021
US Capitol Attack a Wake-up Call for the Integration of Physical & IT Security
Seth Rosenblatt, Contributing Writer,  1/11/2021
IoT Vendor Ubiquiti Suffers Data Breach
Dark Reading Staff 1/11/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15864
PUBLISHED: 2021-01-17
An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL, with a constructor.constructor substring in the username field, that executes a payload when the user visits the /Account/Login page.
CVE-2021-3113
PUBLISHED: 2021-01-17
Netsia SEBA+ through 0.16.1 build 70-e669dcd7 allows remote attackers to discover session cookies via a direct /session/list/allActiveSession request. For example, the attacker can discover the admin's cookie if the admin account happens to be logged in when the allActiveSession request occurs, and ...
CVE-2020-25533
PUBLISHED: 2021-01-15
An issue was discovered in Malwarebytes before 4.0 on macOS. A malicious application was able to perform a privileged action within the Malwarebytes launch daemon. The privileged service improperly validated XPC connections by relying on the PID instead of the audit token. An attacker can construct ...
CVE-2021-3162
PUBLISHED: 2021-01-15
Docker Desktop Community before 2.5.0.0 on macOS mishandles certificate checking, leading to local privilege escalation.
CVE-2021-21242
PUBLISHED: 2021-01-15
OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. AttachmentUploadServlet deserializes untrusted data from the `Attachment-Support` header. This Servlet does not enforce any authentication or a...