sb-nz logo
Story image

Are we security-ready for Alexa in the office?

08 Feb 2019

Forescout has released commentary on the growth of the Internet of Things (IoT) devices in homes, such as Amazon Alexa or Google Home, and what that might mean when they make it into the office.

Despite knowing the security risks inherent in these voice-activated devices, people are embracing them because of the convenience and functionality they offer and this is emblematic of the rise in consumer IoT versus enterprise IoT applications, according to Forescout. 

“There are relatively few organisationally-specific IoT apps being deployed in most enterprises today,” says Forescout Asia Pacific and Japan systems engineering senior director Steve Hunter.

“One example we saw recently was led by workplace resources and placed a Raspberry Pi in every meeting room as part of an experiment to track temperature, humidity, noise levels and room utilisation, but it’s rare to see. 

“There are two broad categories of enterprise IoT devices we see commonly in use. The first are single-vendor complete solutions, such as a company’s IP Telephony system, which has been engineered with security in mind as part of the overall design. The other type is stitched together from multiple vendors, such as enterprise printing systems or IP video surveillance systems, which don’t have a ‘whole-of-system’ view of security engineered into them and are inherently more vulnerable than the first type” 

The next wave of IoT devices to enter the corporate environment In Australia and New Zealand are likely to be these next-generation consumer-facing devices that aren’t necessarily productivity tools but, rather, personal devices that people enjoy using. 

“Tools like Alexa and Home are incredibly useful and convenient. People are used to having them at home and they will want to bring the same level of convenience into the office with them,” Hunter adds.

This will create a second wave of consumerisation of IT in the workplace and IT departments must be prepared with a strategy for managing these devices. 

It’s essential to have policies around how these devices are connected to the network and segmented to avoid creating unnecessary vulnerabilities.

For example, if a number of workers have voice-activated devices like Home and Alexa connected to the corporate network, these could become targets for massive botnet attacks or other hacks that can compromise the user’s personal security as well as the organisation’s security. 

“The risk of IoT devices in the enterprise being absorbed into a botnet, practically speaking, has not been commonly seen in the wild, because companies have a long history of having strong perimeter controls in place,” says Hunter.

“But enterprise IoT devices are normally internally-focused as opposed to personal assistant-style devices that are outward looking towards the public internet. This makes it difficult to assess whether the traffic to and from these devices is malicious compared with internally-focused devices where communication with the public internet is a strong signal the device has been compromised. 

“Unlike the first iteration of the consumerisation of IT, where employees brought their smartphones and tablets to work and IT addressed the newly introduced security risks by deploying mobile device management software on these devices, this second iteration introduces devices where such software agents cannot be used to provide security. 

“The answer to this challenge is for organisations to deploy visibility tools that let them see definitively every device that’s connected to the corporate network, along with that device’s activity. Businesses can then segment the network and treat the devices according to their level of risk. 

“Without that visibility, businesses could find themselves more vulnerable than they were prepared for when allowing consumer IoT devices into the network. And, with the number of personal IoT devices connected to corporate networks continuing to rise, having a plan to address this visibility gap today is essential.” 

Story image
The most popular usernames of all time revealed
Interestingly, usernames one would think might be quite common, such as admin or user, did not make the list of the 200 most popular usernames.More
Story image
ESET launches the latest version of its Mobile Security solution
“With this latest version of ESET Mobile Security, we want to ensure our users feel completely secure when performing financial transactions on their devices, in addition to being protected from malware and phishing attempts."More
Story image
No slowing for collab-tech as Kiwis embrace hybrid working
Technology investment and adoption is a top focus for New Zealand firms post-COVID-19, new Poly research reveals.More
Story image
The guide to digital security in unstable times
An increase in vulnerability across different sectors has meant that 2020 has seen more than its fair share of cybersecurity incidents. One of the most effective ways to combat the perils of today’s cyber-threats is to gain a better knowledge of the threat vectors looming over the heads of organisations. More
Story image
5 ways to use data science to predict security issues - Forcepoint
Data science enables people to respond to problems in a better way, and to also understand those problems in a way that would not have been possible 50 years ago.More
Story image
NortonLifeLock introduces dark web monitoring to its security suite
Dark Web Monitoring Powered by LifeLock will be capable of monitoring the dark web, searching for over 120 personal identifiable information including email, physical address, phone number, driver licence number, credit card or bank account numbers and gamer tags.More