Story image

IoT device security is a business responsibility, too

09 May 18

IoT devices provide ample opportunity to attackers looking to use them as entry points for network compromise schemes – and despite the risks, security is still being overlooked.

ESET says that the Internet of Things has gone beyond a trendy buzzword to a genuine set of emerging technologies that will improve business operations and improve experiences for consumers.

However, the security issues that plague IoT devices persist, leading to devices that have little or no built-in security.

ESET senior research fellow Nick FitzGerald explains that even when basic security measures are built in, users don’t often change usernames or passwords from the defaults. This, he says, makes it easier for hackers to gain access to the devices.

“Many of these devices are used in applications that make their security critical. For example, automatic braking systems in trains or buses could create life-threatening situations if they were sabotaged by cybercriminals. It’s therefore essential to carefully consider security when implementing IoT devices and to not trust that security will be managed by the vendor,” he explains.

There is one way to address this challenge, which is to use ‘mutually-suspicious platforms.

The company explains:

“Isolating cores, memory, applications, operating system code, and other resources can form a breach-resistant group of barriers. This can make it more difficult for software developers, but the resulting applications are also far more secure, making this approach ideal when safety is at stake.”

Airgapped systems may have been secure in the past such as Controller Area Network (CAN bus) or ICS-related protocols, but they are now more likely to be fully connected and vulnerable to attack. They must also be defended.

FitzGerald says that cyber attacks are growing more intense, more severe, and are happening more often.

“IoT devices and other connected networks are providing new ways for attackers to sneak in the back door of organisations.”

“Businesses shouldn’t let this stop them from embracing new and emerging technologies, especially those that promise to deliver business efficiencies and potential new revenue streams. However, it is essential for businesses to be well aware of the security implications and take the right steps to protect their networks.” 

He says that organisations should choose IoT products that include security by design. They should also look for vendor commitments surrounding product maintenance, and those who deliver firmware or software updates for the device’s entire serviceable life.

“This approach removes the need for consumers or organisations to make security-related decisions by defaulting to secure settings. Two ways businesses can improve IoT security is to change default passwords to unique passwords and to regularly update the product with patches and other security updates.” 

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
GCSB welcomes Inspector-General's report on intelligence warrants
Intelligence warrants can include surveillance, private communications interception, searches of physical places and things, and the seizure of communications, information and things.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."