Vulnerabilities / Threats

8/9/2017
06:30 PM
50%
50%

SMBs Practice Better IoT Security Than Large Enterprises Do

Small-to midsized businesses are more prepared than big ones to face the next IoT attack: good news given the sharp rise in IoT botnet attacks in the first half of 2017, new reports released today show.

Massive IoT botnet Mirai helped fuel a 280% rise in telnet botnet attack activity in the first half of the year over the previous period, but small-to midsized (SMB) business are surprisingly better prepared to deal with IoT threats in general than large enterprises, according to data from separate IoT reports released today.

In its survey of 950 IT professionals from SMBs to large enterprises, Pwnie Express found SMBs check their wireless devices for malicious infections and their employees' BYOD devices for malicious infections with greater frequency than large enterprises.

Some 64% of SMBs checked their wireless devices for infections in the last month, compared to 55% of large enterprises. Nearly one-third of SMBs reviewed employees' BYOD devices for malware in the previous month, compared with 20% of large companies. 

These steps not only help address IoT security in general, but may also aid in preventing SMB IoT devices from getting infected and becoming part of a bot army.  

According to F5 Labs' new report on botnets, not only was there a dramatic three-digit rise in botnet activity in the first half of the year, but most of that movement happened in the first two months. It has been much quieter since then, and F5 believes attackers may have completed their reconnaissance of vulnerable IoT devices and are now the process of potentially building massive botnets.

"We are seeing just the tip of the iceberg" for IoT botnets, says Sara Boddy, F5 Labs lead and author of the company's report, 2017 Rise of the Thingbots.

Approximately two years ago, telnet brute-force attacks were rather uncommon, she says. But with the rising popularity of IoT devices, which typically use the telnet protocol and Port 23 to allow remote administration of the device, Boddy says she expects to see a wide swath of IoT devices hijacked into botnet armies by way of the telnet protocol.

"A lot of IoT devices use Port 23 because when they were designed, no one ever thought a parking meter, teddy bear, or TV would be attacked," Boddy explains.

She adds that telnet-enabled IoT devices are not only easy to attack but they are also a cost-effective means for building a botnet army. IoT devices usually don't have security features in them and may require little direct user interaction like a remotely controlled thermostat, Boddy says. As a result, an attacker has a good chance of keeping an IoT-infected device alive, compared to Grandma's infected computer that gets fixed and then the attacker loses a bot, she notes.

Meanwhile, the pool of potential botnet army targets is expected soar. Gartner is forecasting a 31% year-over-year jump in the number of IoT devices by the end of the year to 8.4 billion.

Businesses with IoT devices running on their networks should take precautions to avoid a DDoS attack by using or having a scrubbing service on call that can handle an onslaught of at least 1 terabyte per second, Boddy suggests.

She also advises organizations to run Web Application Firewalls (WAFs), along with ID access and management tools with single-sign on, and two-factor authentication to help with credential stuffing.

When it comes to SMBs, Boddy says it's important to have a DDoS solution, in addition to other tools to plug the main vectors of attack. "Sometimes these things are cost prohibitive, but at least they should be aware of their known threat gaps," she says.

However, SMBs, generally have smaller security teams and might not have the resources necessary to deal with the IoT threat potential, she notes.

Some Props for SMB IoT Security 

The Pwnie Express, however, has a different assessment of SMBs. Pwnie's report, "Is Bigger Better? How Small & Midsized Organizations Are Better at Closing the IoT Security Gap,"  found 62% of SMBs know how many IoT devices are connected to their network, compared to 47% of large companies.  

Although it stands to reason SMBs may have a better handle on the number of IoT devices on their networks because there are fewer of them compared to large enterprises, there is another more significant reason at play, says Dimitri Vlachos, Pwnie's vice president of marketing.

"Large companies have silos, so when you see an adoption of new technology, the IT department is not always told. But at SMBs, IT departments tend to hear about it because the organizations tend to be flatter," Vlachos says.

SMBs have also been known to involve IT security at their companies when considering new hardware and software to purchase, says Yolanda Smith, Pwnie's director of product management.

Meanwhile, SMBs also tend take responsibility for the IT security of employees' BYOD devices, whereas large corporations maintain more of a hands-off approach, Vlachos says.

Small companies may find the need to be more proactive with an employee's IoT device because a security breach can be far more devastating to a mom-and-pop operation than a Fortune 500 company with deep pockets, he adds.

Although SMBs are more prepared to deal with IoT security, it does not necessarily translate into their ability to fend off a massive DDoS attack. And Vlachos says SBMs are not usually the target of a DDoS attack, anyway.

Related Content:

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.