Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.
The Internet of (Secure) Things Checklist
Insecure devices put your company at jeopardy. Use this checklist to stay safer.
Rinki Sethi, Senior Director of Security Operations and Strategy of Palo Alto Networks
January 4, 2018
4 Min Read
In October 2016, as a botnet strung together by the Mirai malware launched the biggest distributed denial-of-service attack in history, I was, appropriately enough, giving a talk on Internet of Things (IoT) security and privacy at the Grace Hopper Conference. As I learned of the attack, and as questions came in from the audience about the malware, I knew that the topic of my session could not have been more timely. In this instance, and in countless others, IoT security is a core issue. Security professionals need to be concerned about insecure devices.
More than a year later, IoT continues to be a growing concern. From Internet-connected toaster ovens to smart hairbrushes to popular health trackers, these devices can be risky, especially when used in certain environments. Given the prevalence of these devices coming in and out of corporate networks, not only is it important to be ready to protect your own organization, but it is crucial to understand how far IoT risk can extend.
As the AT&T IoT Cybersecurity Alliance highlighted in a recent white paper, Mirai was a prime example of the type of risk posed by unsecured IoT devices. The obvious threat is exposure of personal data to an attacker who compromises a device. However, according to the report, if the connected devices within your organization are used as part of a widespread attack, your organization could suffer reputational damage or, worse, your organization could be victimized by a compromised IoT device from a business partner.
Just like any type of cyberattack, the implications of an IoT attack are far-reaching. This is why it is important for security professionals to approach IoT security just as they would network, endpoint, and cloud security. A comprehensive cyber hygiene strategy is a necessary component of securing your organization and preventing cyber attacks.
Security teams should review their current priorities and reference this basic IoT security hygiene checklist:
Assess your company's overall risk acceptance. Every company has a different view of the types of risks they are willing to accept, and it's critical you understand your company's overall risk acceptance. This is an important first step, as it will help you determine which devices you will allow to connect and which devices you will need to block. For example, some companies may find it to be low-risk if users connect health-tracking devices to company laptops, allowing them to transfer personal health data. Other companies with a different security posture may find this to be a high risk.
Develop an IoT awareness and training program. Employees need to be aware of the risk that connected devices present. In order for them to be IoT savvy, they need proper resources and training. An integral part of developing their awareness is making sure they understand how their personal devices are part of the bigger picture and overall security of their workplace — and what is allowed and what is not. Training also should include how to do IoT health checks to determine if devices are secure. It is important to provide employees with the tools needed to protect themselves and the organization, whether that means a required course on IoT risk and cyber hygiene or a video starring the executive staff that demonstrates possible IoT threat scenarios.
Practice what you preach. A personal device hygiene check is always a good reminder about the importance of IoT security. Going through this process yourself will help you figure out what should be included in your company's IoT hygiene program. I make a habit of regularly checking through the apps on my phone to see what access they have. Many devices request access to photos, location information, and contacts; ask yourself if you want to allow this. Keeping IoT devices up to date and ensuring the proper privacy settings are in place are important steps for securing your own device and for securing the networks and other devices that they connect to, including company laptops and mobile phones.
Gartner predicts that more than 20 billion connected devices will be in operation by 2020, rising from 8.4 billion in 2017. The security investments made by companies creating these billions of devices are just as diverse as the devices themselves. There are some IoT companies investing in a lot in security, while others are focusing only on creating connected devices — and security may be an afterthought. As security practitioners, we should take this into consideration when assessing IoT risk for our organizations and users. There is a lot we can do to ensure we are one step ahead when it comes to IoT security.
Related Content:
About the Author
You May Also Like
More Insights
