Vulnerabilities / Threats

SMBs Practice Better IoT Security Than Large Enterprises Do

Small-to midsized businesses are more prepared than big ones to face the next IoT attack: good news given the sharp rise in IoT botnet attacks in the first half of 2017, new reports released today show.

Massive IoT botnet Mirai helped fuel a 280% rise in telnet botnet attack activity in the first half of the year over the previous period, but small-to midsized (SMB) business are surprisingly better prepared to deal with IoT threats in general than large enterprises, according to data from separate IoT reports released today.

In its survey of 950 IT professionals from SMBs to large enterprises, Pwnie Express found SMBs check their wireless devices for malicious infections and their employees' BYOD devices for malicious infections with greater frequency than large enterprises.

Some 64% of SMBs checked their wireless devices for infections in the last month, compared to 55% of large enterprises. Nearly one-third of SMBs reviewed employees' BYOD devices for malware in the previous month, compared with 20% of large companies. 

These steps not only help address IoT security in general, but may also aid in preventing SMB IoT devices from getting infected and becoming part of a bot army.  

According to F5 Labs' new report on botnets, not only was there a dramatic three-digit rise in botnet activity in the first half of the year, but most of that movement happened in the first two months. It has been much quieter since then, and F5 believes attackers may have completed their reconnaissance of vulnerable IoT devices and are now the process of potentially building massive botnets.

"We are seeing just the tip of the iceberg" for IoT botnets, says Sara Boddy, F5 Labs lead and author of the company's report, 2017 Rise of the Thingbots.

Approximately two years ago, telnet brute-force attacks were rather uncommon, she says. But with the rising popularity of IoT devices, which typically use the telnet protocol and Port 23 to allow remote administration of the device, Boddy says she expects to see a wide swath of IoT devices hijacked into botnet armies by way of the telnet protocol.

"A lot of IoT devices use Port 23 because when they were designed, no one ever thought a parking meter, teddy bear, or TV would be attacked," Boddy explains.

She adds that telnet-enabled IoT devices are not only easy to attack but they are also a cost-effective means for building a botnet army. IoT devices usually don't have security features in them and may require little direct user interaction like a remotely controlled thermostat, Boddy says. As a result, an attacker has a good chance of keeping an IoT-infected device alive, compared to Grandma's infected computer that gets fixed and then the attacker loses a bot, she notes.

Meanwhile, the pool of potential botnet army targets is expected soar. Gartner is forecasting a 31% year-over-year jump in the number of IoT devices by the end of the year to 8.4 billion.

Businesses with IoT devices running on their networks should take precautions to avoid a DDoS attack by using or having a scrubbing service on call that can handle an onslaught of at least 1 terabyte per second, Boddy suggests.

She also advises organizations to run Web Application Firewalls (WAFs), along with ID access and management tools with single-sign on, and two-factor authentication to help with credential stuffing.

When it comes to SMBs, Boddy says it's important to have a DDoS solution, in addition to other tools to plug the main vectors of attack. "Sometimes these things are cost prohibitive, but at least they should be aware of their known threat gaps," she says.

However, SMBs, generally have smaller security teams and might not have the resources necessary to deal with the IoT threat potential, she notes.

Some Props for SMB IoT Security 

The Pwnie Express, however, has a different assessment of SMBs. Pwnie's report, "Is Bigger Better? How Small & Midsized Organizations Are Better at Closing the IoT Security Gap,"  found 62% of SMBs know how many IoT devices are connected to their network, compared to 47% of large companies.  

Although it stands to reason SMBs may have a better handle on the number of IoT devices on their networks because there are fewer of them compared to large enterprises, there is another more significant reason at play, says Dimitri Vlachos, Pwnie's vice president of marketing.

"Large companies have silos, so when you see an adoption of new technology, the IT department is not always told. But at SMBs, IT departments tend to hear about it because the organizations tend to be flatter," Vlachos says.

SMBs have also been known to involve IT security at their companies when considering new hardware and software to purchase, says Yolanda Smith, Pwnie's director of product management.

Meanwhile, SMBs also tend take responsibility for the IT security of employees' BYOD devices, whereas large corporations maintain more of a hands-off approach, Vlachos says.

Small companies may find the need to be more proactive with an employee's IoT device because a security breach can be far more devastating to a mom-and-pop operation than a Fortune 500 company with deep pockets, he adds.

Although SMBs are more prepared to deal with IoT security, it does not necessarily translate into their ability to fend off a massive DDoS attack. And Vlachos says SBMs are not usually the target of a DDoS attack, anyway.

Related Content:

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
Box Mistakes Leave Enterprise Data Exposed
Dark Reading Staff 3/12/2019
How the Best DevSecOps Teams Make Risk Visible to Developers
Ericka Chickowski, Contributing Writer, Dark Reading,  3/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.