Why Enterprises Can't Ignore Third-Party IoT-Related Risks

The Internet of Things (IoT) is one of the greatest technological advancements in the last decade, so it's no wonder that the IoT market is expected to grow to 20.4 billion devices by 2020 and more than 8.4 billion IoT devices are already in use today.

According to a new report by the Ponemon Institute and Shared Assessments, "The Internet of Things (IoT): A New Era of Third Party Risk," it is estimated that every workplace has approximately 16,000 IoT devices connected to its network. Given the prevalence of IoT adoption, it makes sense that IoT presents a major threat vector for hackers who have discovered new entry points for cyberattacks. Basically, any device with an Internet connection is subject to being compromised and can become a back door for attackers to access enterprises or steal other sensitive data.

Unfortunately, many IoT devices run on firmware that is often difficult to patch and update, and some come with default passwords that are easy to crack. We've already seen plenty of distributed denial-of-service (DDoS) attacks through IoT devices, including the Mirai botnet and Brickerbot, IoT ransomware, malware, and more. Over the past two years, baby monitors, robots, smart TVs and refrigerators, Nest thermostats, and even connected cars have made headlines for being hacked.

Many enterprises are finally realizing the growing attack surface that IoT devices bring to the workplace, and some are beginning to monitor for these endpoints. But what happens when an IoT device that's connected to a corporate network by a third party suddenly becomes compromised? Is that enterprise monitoring its third parties for IoT risks? Is there a policy in place to handle risky third-party IoT devices? According to this new research, many enterprises are ill prepared for this uphill IoT risk management battle.

Shared Assessments commissioned Ponemon to survey 605 individuals who participate in corporate governance and/or risk oversight activities and are familiar with the use of IoT devices in their organization. The study found that while there have been some advances in third-party risk focused on IoT devices and applications since 2017, risk management in this area is still at a relatively low level of maturity. It revealed that almost all respondents (97%) believe their organization will suffer from a catastrophic IoT-related security event in the next two years, yet many aren't properly assessing for third-party IoT risks and many don't have an accurate inventory of IoT devices or applications.

The report underscores three major disconnects when it comes to third-party risk management practices, including:

The awareness of IoT risks is increasing as IoT adoption grows: With an increasing reliance on IoT devices in the workplace, organizations are realizing the magnitude of what an attack related to an unsecured IoT device could do to their business. Eighty-one percent of survey respondents say that a data breach caused by an unsecured IoT device is likely to occur in the next 24 months, and 60% are concerned the IoT ecosystem is vulnerable to a ransomware attack. However, only 28% say they currently include IoT-related risk as part of the third-party due diligence.

IoT risk management practices are uneven: The average number of IoT devices in the workplace is expected to grow from 15,875 to 24,762 over the next two years, so it's not surprising that only 45% of respondents believe it's possible to keep an inventory of such devices, while only 19% inventory at least 50% of their IoT devices. A large majority, 88%, cite lack of centralized control as a primary reason for the difficulty of completing and maintaining a full inventory. Even though 60% of respondents say their organization has a third-party risk management program in place, less than half of organizations (46%) say they have a policy in place to disable a risky IoT device within their own organization.

The gap between internal and third-party IoT monitoring is substantial: Almost half of all organizations say they are actively monitoring for IoT device risks within their workplace, but more concerning is that only 29% are actively monitoring for third-party IoT device risks. A quarter of respondents admit they are unsure if their organization was affected by a cyberattack involving an IoT device, while 35% said they don't know if it would be possible to detect a third-party data breach. Shockingly, only 9% of respondents say they are fully aware of all of their physical objects connected to the Internet.

The bottom line is that more focus is being given to internal workplace IoT device risks than to risks posed by third parties. Many companies have fallen behind on the basics such as assigning accountability and inventory management, and there are uncertainties around who is responsible for managing and mitigating third-party risks. There's also an over-reliance on third-party contracts and policies for IoT risk management.

To more effectively address IoT risks and improve third-party risk management programs, companies should take the following proactive steps: