SPECIAL FOCUS INTERNET OF THINGS
INTERNET OF BROKEN THINGS? A
Ian Kilpatrick, Nuvias Group, discusses the security issues companies need to consider when introducing IoT devices
recent survey shows 64 per cent of organisations have deployed some
level of Internet of Things (IoT) technology, and another 20 per cent plan to do so within the next 12 months. This is an astonishing fact when you consider the lack of basic security on these devices, or any established security standards. Many companies are turning a blind eye to security issues, swayed by the potential benefits that IoT can bring.
IOT - A CYBERCRIMINAL’S DREAM Any device or sensor with an IP address connected to a corporate network is an entry point for hackers and other cybercriminals – like leaving your front door wide open for thieves. Managing endpoints is already a
challenge, but the IoT will usher in a raft of new network-connected devices that threaten to overwhelm the IT department charged with securing them – a thankless task considering the lack of basic safeguards in place on the devices. Of particular concern is that many IoT devices are not designed to be secured or updated after deployment. Any vulnerabilities discovered post deployment cannot be protected against in the device; and corrupted devices cannot be cleansed.
IT OR OT
IT professionals are more used to securing PCs, laptops and other devices, but they will now be expected to become experts in areas such as smart lighting, heating and air conditioning systems, security cameras and integrated facilities management systems. A lack of experience in this Operating Technology (OT) is a cause for concern. It is seen as operational rather than strategic, so deployment and management is often shifted well away from Board awareness and oversight. Nevertheless, the majority of organisations are deploying IoT technology with minimal regard to the risk profile or the tactical requirements needed to secure them against unforeseen consequences.
INCREASE IN DDOS ATTACKS DDoS (Distributed Denial of Service) attacks are on the rise, with 41 per cent of UK organisations saying they have experienced one. IoT devices are a perfect vehicle for
criminals to access a company’s network. The high-profile Mirai attack used IoT
38 APRIL 2018 | INSTRUMENTATION
devices to mount wide-scale DDoS attacks that disrupted internet service for more than 900,000 Deutsche Telekom customers in Germany, and infected almost 2,400 TalkTalk routers in the UK.
…AND RANSOMWARE ATTACKS There has been an almost 2,000 per cent jump in ransomware detections since 2015. In 2017, WannaCry targeted more than 200,000 computers across 150 countries, with damages ranging from hundreds to billions of dollars. While most ransomware attacks currently infiltrate an organisation via email, IoT presents a new delivery system for both mass and targeted attacks.
INCREASING INTENSITY AND SOPHISTICATION OF ATTACKS The sophistication of attacks targeting organisations is accelerating at an unprecedented rate, with criminals leveraging the disruptive opportunities the IoT brings. According to Fortinet’s latest Quarterly
Threat Landscape report, three of the top twenty attacks identified in Q4 2017 were IoT botnets. But unlike previous attacks, which focused on a single vulnerability, new IoT botnets such as Reaper and Hajime target multiple vulnerabilities simultaneously, which is harder to combat. Wi-Fi cameras were targeted by
criminals, with more than four times the number of exploit attempts detected over Q3 2017.
THE EFFECTS OF AN ATTACK The aftermath of a cyberattack can be devastating for any company, leading to huge financial losses, compounded by regulatory fines for data breaches, and plummeting market share or job losses. At best, a company could suffer irreparable reputational damage and loss of customer loyalty. On top of that, IoT devices have the potential to create organisational and infrastructure risks, and even pose a threat to human life, if attacked. We have already seen the impact of nation-state attack tools being used as nation state weapons, then getting out and being used in commercial criminal activity.
PROFIT OVER SECURITY It is crazy to think that devices with the potential to enable so much damage to homes, businesses and even entire cities
often lack basic security design, implementation and testing. In the main this is because device manufacturers are pushing through their products to get them to market as quickly as possible, to cash in on the current buzz around IoT. Lawrence Munro, vice president
SpiderLabs at Trustwave, agrees IoT manufacturers are sidestepping security fundamentals: “We are seeing lack of familiarity with secure coding concepts resulting in vulnerabilities, some of them a decade old, incorporated into final designs.”
Ian Kilpatrick, EVP Cyber Security, Nuvias Group
CAN YOU SEE THE PROBLEM? Another huge problem is that once a network is attacked, it is much easier for subsequent attacks to occur. Yet, recent data shows just half of IT
decision makers feel confident they have full visibility and control of all devices with network access. The same percentage believe they have full visibility of the access level of all third parties, who frequently have access to networks; and only 54 per cent say they have full visibility and control of all employees.
TURNING A BLIND EYE Despite security concerns often cited as the number one barrier to greater IoT adoption, Trustwave research shows 61 per cent of firms who have deployed some level of IoT technology have had to deal with a security incident related to IoT, and 55 per cent believe an attack will occur sometime during the next two years. Only 28 per cent of organisations surveyed consider that their IoT security strategy is ‘very important’ when compared to other cybersecurity priorities.
EFFORTS TO STANDARDISE In the UK, the government’s five-year National Cyber Security Programme (NCSP) is looking to work with the IT industry to build security into IoT devices through its ‘Secure by Default’ initiative. The group published a review earlier this month that proposes a draft Code of Practice for IoT manufacturers and developers. While there seems to be some light at
the end of the tunnel, it may not be enough. Regulators will not force device manufacturers to introduce the necessary security regulations and practices before thousands of businesses fall victim to attacks. Turning a blind eye to the IoT security risks could leave your organisation permanently paralysed.
Nuvias Group
www.wickhill.com
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52
