How to Secure Your IoT Ecosystem in the Age of 5G

The Internet of Things is becoming an integral part of business and daily life, affecting everything from monitoring products in a warehouse to tracking your heartrate and sleeping patterns. Gartner predicts that by the end of this year, 5.8 billion enterprise and automotive IoT endpoints will be in use. And now, with deployment of 5G on the horizon and the massive expansion of IoT devices, a new security challenge is emerging.

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface. In a recent study by AT&T Cybersecurity, 44% of respondents stated this was their top business concern when it comes to 5G, while 39% identified the increase in connected devices to the network as their top concern. The number of connection points to the network, human and machine, will create new opportunities for bad actors to weaponize currently known manageable threats. 

While 5G is inherently more secure with its built-in security measures (including network slicing, stronger over-the-air encryption, subscriber identity protection, and reduced risk of eavesdropping) to address many business needs, enterprises should be proactive in adjusting their security policies and controls. Here are four tips for organizations to keep their networks safe in this new 5G connected world.

Adopt virtualized, automated security controls 
This will help organizations manage the expanded attack surface and mitigate future risk. Virtualized security can be deployed quickly and allows organizations to respond immediately to new attacks with an automated response such as creating a firewall. 

Implement machine learning and threat detection
You're going to need to be able to better monitor and analyze the increased amount of activity across your network. Machine learning and automated threat detection are necessary, since manual intervention will no longer be able to sift through and react to the amount of data 5G will bring.

Consider a zero-trust approach
Using zero trust for identity and authorization across all devices in your organization lowers the possibility of the introduction of malware on the network. By continually checking a user’s presence and behavior, a zero-trust model will help your security team quickly determine whether the user is human or machine.

Embrace a shared security model
IoT devices will continue to have vulnerabilities, such as factory-default passwords remaining in production, and organizations will need to take responsibility for safeguarding against rogue devices. Just as in the public cloud, a shared security model for 5G will help providers allow for security in the infrastructure by using the network itself as a security tool, while organizations tackle the endpoints.

In a shared security model, the enterprise would assume responsibility for devices on the network. And, with 5G, the network operator is responsible for the elements of security listed out in 3GPP frameworks and standards (i.e. data encryption and radio access network) as well as  handling the security of the network infrastructure itself, while the enterprise would assume responsibility for devices on the network including mobile device management, certification of applications that the enterprise runs on the network, and identity and access management.

With the influx of devices connected to 5G, adopting a holistic, multi-layered approach will be key to helping protect your IoT ecosystem and other valuable assets. Every organization’s IT and security infrastructure has a different design, which also means each organization’s security needs will differ. A factory floor, for example, that uses a number of industrial IoT devices to produce automobiles will have different security measures than a life-sensitive device, like an insulin pump, that is dependent on remediation and response plans. Even if someone is accessing the data, the device would not want to be disabled.

While there are controls to help prevent end devices from infecting carrier 4G networks, a single device has been known to impact enterprise networks. In 2018, hackers used a smart fish tank in a Las Vegas casino to access and move laterally throughout the network to steal 10 gigabytes of data. Anything that's connected can be a weak link for hackers to gain entry to your network. Take a step back to look at how your IoT networks are connected to your traditional IT networks to determine how to segment them. This will help limit risks in an organization’s IoT ecosystem. 

5G is coming, and along with it is a stream of IoT devices and new technologies. But organizations must keep in mind that this means the attack surface is also going to expand significantly and increase opportunities for bad actors. Adopting a multi-layered approach, identifying the interconnectivity of devices and its physical environment, as well as deploying virtualization and automation among other defenses, will help to lessen risk and prepare organizations for the promises of IoT in a 5G world.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Top story: "7 Steps to IoT Security in 2020."