Story image

IoT device security is a business responsibility, too

09 May 2018

IoT devices provide ample opportunity to attackers looking to use them as entry points for network compromise schemes – and despite the risks, security is still being overlooked.

ESET says that the Internet of Things has gone beyond a trendy buzzword to a genuine set of emerging technologies that will improve business operations and improve experiences for consumers.

However, the security issues that plague IoT devices persist, leading to devices that have little or no built-in security.

ESET senior research fellow Nick FitzGerald explains that even when basic security measures are built in, users don’t often change usernames or passwords from the defaults. This, he says, makes it easier for hackers to gain access to the devices.

“Many of these devices are used in applications that make their security critical. For example, automatic braking systems in trains or buses could create life-threatening situations if they were sabotaged by cybercriminals. It’s therefore essential to carefully consider security when implementing IoT devices and to not trust that security will be managed by the vendor,” he explains.

There is one way to address this challenge, which is to use ‘mutually-suspicious platforms.

The company explains:

“Isolating cores, memory, applications, operating system code, and other resources can form a breach-resistant group of barriers. This can make it more difficult for software developers, but the resulting applications are also far more secure, making this approach ideal when safety is at stake.”

Airgapped systems may have been secure in the past such as Controller Area Network (CAN bus) or ICS-related protocols, but they are now more likely to be fully connected and vulnerable to attack. They must also be defended.

FitzGerald says that cyber attacks are growing more intense, more severe, and are happening more often.

“IoT devices and other connected networks are providing new ways for attackers to sneak in the back door of organisations.”

“Businesses shouldn’t let this stop them from embracing new and emerging technologies, especially those that promise to deliver business efficiencies and potential new revenue streams. However, it is essential for businesses to be well aware of the security implications and take the right steps to protect their networks.” 

He says that organisations should choose IoT products that include security by design. They should also look for vendor commitments surrounding product maintenance, and those who deliver firmware or software updates for the device’s entire serviceable life.

“This approach removes the need for consumers or organisations to make security-related decisions by defaulting to secure settings. Two ways businesses can improve IoT security is to change default passwords to unique passwords and to regularly update the product with patches and other security updates.” 

Avi Networks: Using visibility to build trust
Visibility, also referred to as observability, is a core tenet of modern application architectures for basic operation, not just for security.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.
Myth-busting assumptions about identity governance - SailPoint
The identity governance space has evolved and matured over the past 10 years, changing with the world around it.
Forrester names Crowdstrike leader in incident response
The report provides an in-depth evaluation of the top 15 IR service providers across 11 criteria.
Slack doubles down on enterprise key management
EKM adds an extra layer of protection so customers can share conversations, files, and data while still meeting their own risk mitigation requirements.
Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.