5 Ways To Prepare For IoT Security Risks

Enterprises can expect to see some fundamental changes in the information security and data privacy landscape as the Internet of Things (IoT) begins to take shape over the next several years.

The sheer diversity of IoT assets and the myriad ways in which they connect with each other and the enterprise network will raise new IT governance and cybersecurity challenges, Verizon said in a status report on the IoT market this week. Dealing with the changes will require a new way of thinking about IT security and management, the report noted.

“Because IoT is all about physical “things,” hackers that gain access can not just perform the usual digital attacks like stealing data, moving money, or shutting down websites,” Verizon said. They can also cause physical havoc by tampering with critical infrastructure like electric grids, SCADA systems, healthcare devices, and aviation systems.

For the most part, the Verizon report offers a review of how organizations in different industries have already begun deriving measurable business value from IoT projects. As examples, it points to transportation companies that are saving millions of dollars on fuel consumption by using IP-enabled devices to track and manage fleets, local governments stretching their budget dollars via smart street lighting projects and utilities improving operations via smart meters.

Organizations across sectors are harnessing IoT technologies to increase revenues, improve operational efficiencies and find new ways to do thing, Verizon noted.

But the trend also presents new challenges, Verizon noted. Every Internet-enabled sensor and device in an IT environment presents a potential security risk. Verizon pointed to a 2014 report by Hewlett-Packard showing 70 percent of the most commonly used IoT devices, such as smart thermostats and home security systems, contain serious security vulnerabilities.

Even the most security-conscious organizations may be unprepared for the full security impact of a world in which tens of billons of devices and things are connected to the Internet, the report noted.

Johan Sys, managing principal of identity and access management at Verizon Enterprise Solutions, says as more things join the established Internet, they are likely to present the same kind of attack opportunities as the devices that first made up the Internet. “As long as there is value in the information exchanged by connected devices, there will be malicious actors who will attack the applications running on the network,” Sys said in emailed comments to Dark Reading. There are several measures that organizations can take to prepare for the risks, he said.

1. Bake security into IoT applications from the start

Because of its highly interconnected nature, the IoT amplifies the impact of security vulnerabilities, says Daniel Miessler, an HP security researcher involved in the 2014 IoT report. “We have broken network security, broken web security, broken cloud security,” he says. “What the IoT does is take all of these vulnerabilities and smash them together into one product. We should not be surprised there are issues,” Miessler says.

One of the first things developers of IoT applications should focus on, according to Sys, is building in security from the start. “This needs to include ways of updating the system in a secure manner,” he said.

2. Identify Risks

Know the specific threats you are facing: “The risks associated with connected vehicles are different to those facing a smart grid," Sys said. Know what your organization’s risk exposure is, plan for compromises, and have a clear idea of what to do when that happens.

The most common IoT vulnerabilities include web interface authentication and authorization, lack of transport encryption security, insufficient security configurability, and poor physical controls, Miessler says. Enterprises need to be aware of such risks and review the components of their IoT environment to identify and eliminate them, he notes.

3. Segment Networks

Because security errors tend to get magnified in an IoT environment, organizations need to keep their IT networks properly segmented from the IoT to prevent a security issue in one part of the network enabling or leading to problems in other parts of the network, Miessler said.

An organization that deploys an enterprise system to manage an industrial control system for instance has to manage two separate sets of security issues while keeping the two environments properly segmented.

4. Have a layered security system

Traditional IT security controls such as firewalls, intrusion detection systems, and anti-virus tools, will not be enough to protect IoT assets, Sys said. Even the user experience may not be a human experience. “If security measures such as passwords require human involvement, the system will either be inefficient or avoided entirely,” he said.

In addition, many IoT components are not equipped to deal with security issues and have minimal support for security patches and software updates, Miessler said. Often the patches themselves are easily compromised and can be used to deliver malware instead.

Dealing with such issues will require companies to deploy multi-layered controls for mitigating threats.

5. Be prepared to share security responsibility

Miessler expects IoT security to “absolutely be a shared jurisdiction” in which IT groups will need to coordinate security efforts with physical security teams and device manufacturers. Where manufactures are reluctant to take on the responsibility for integrating better security, organizations will need to put pressure on them to do so, he said.