Now, we\u2019re not going to inundate you with all of the IoT security statistics we\u2019ve seen \u2014 you can read more of those on your own in our IoT statistics<\/a> article. But the point here is that IoT devices are here to stay, and it\u2019s up to companies to decide how they\u2019ll be used \u2014 whether they\u2019re useful and secure assets or vulnerable targets for attackers.<\/p>\n\n\n\n The so-called internet of things (IoT) includes many devices found in homes and businesses across all industries. It includes network-connected devices as well as those that use other connectivity protocols (such as RFID and Bluetooth). But what does this growing reliance on connected technologies mean for businesses in terms of IoT security? We\u2019ve asked 11 security executives, developers, and other IT experts to help us answer that and other IoT and security-related questions.<\/p>\n\n\n\n In this article, we\u2019ll answer the question \u201cwhat is IoT security?\u201d and explore what internet of things security entails, why it\u2019s historically been an issue to achieve, and what companies and governments are doing to address IoT security issues.<\/p>\n\n\n\n Let\u2019s hash it out.<\/span><\/p>\n\n\n\n Internet of things security is a sector of information technology that focuses on securing endpoint devices, networks, and data relating to the internet of things (i.e., connected devices that aren\u2019t computers, smartphones or tablets). Basically, IoT security is a broad term encompassing the security strategies, policies, processes, and technologies that companies use to protect their IoT devices (everything from smart refrigerators and security cameras to monitors on jet engines or automobiles) and their associated data, applications and networks from being hacked or otherwise compromised.<\/p>\n\n\n\n But why is IoT security necessary? After all, \u201csmart\u201d technologies have smart in the name, so that means they should also be secure, right? We wish. Unfortunately, that assumption about IoT security is often far from the truth as many IoT devices aren\u2019t as secure as you might think.<\/p>\n\n\n\n According to Mike Nelson, Vice President of IoT Security at DigiCert<\/a>, says it well:<\/p>\n\n\n\n \u201cAt its core, the IoT is about connecting things to create new, actionable data. Anytime connectivity is introduced into a system, cyber risks go up. If left unsecured, this connectivity can open backdoors into the organization\u2019s network. In addition, with growing connectivity, the new data being generated and transmitted creates additional risks. Whenever this data contains sensitive business or personal information it must be handled in a confidential way.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n The more devices you add to your network (i.e., the more connections and entry points you create), the less secure your network becomes. If even just one of those devices has an unpatched vulnerability that an attacker exploits, then your data is at risk of exfiltration and compromise. And with so many devices in the market \u2014 and more being added daily \u2014 IoT represents a rapidly growing attack surface that bad guys can use to target your organization.<\/p>\n\n\n\n When users and companies buy IoT devices, there\u2019s an understandable expectation that those devices are secure. However, regardless of what any salesperson tells you, no technology or software is 100% secure.<\/p>\n\n\n\n IoT devices are designed and programmed by people, and people make mistakes and miss things. In some cases, a seemingly insignificant mistake can become a major exploit down the road. Of course, the significance and impact vary and may increase based on the target organization\u2019s industry and the attacker\u2019s goals. To put this another way, although a vulnerability in a smart refrigerator can result in data theft, a vulnerability in a smart medical device can result in significant harm or death to an individual. <\/p>\n\n\n\n According to Niko Sagiadinos, a developer and owner of the digital signage company SmilControl<\/a>:<\/p>\n\n\n\n \u201cIoT devices can be used as gateway to the company\u2019s or country\u2019s digital infrastructure. Trojan horses for espionage, malware for sabotage and ransomware for blackmail fraud.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Furthermore, IoT devices currently lack universal certifications and standards. They\u2019re not like root of trust devices such as trusted platform modules<\/a> (TPMs), which have vendor-neutral standards that developers and manufacturers must meet. And without those go-to trusted standards for device manufacturers and end-users to abide by, IoT is still a bit of a Wild West.<\/p>\n\n\n\n If you\u2019ve read any of the major headlines in recent years, it should be apparent how and why IoT security is critical. Let\u2019s consider the WannaCry ransomware attacks<\/a> of 2017. To quickly summarize, that global security event involved attackers leveraging a security vulnerability in legacy Microsoft Windows operating systems. Prior to the attack, Microsoft released a patch to fix the issue \u2014 but many companies failed to apply the patch to their systems, leaving their systems vulnerable.<\/p>\n\n\n\n The same concept applies to IoT security. These devices also have known and unknown vulnerabilities that attackers can exploit in the future (if they haven\u2019t already done so). In fact, the Dyn attack, which Forbes says was responsible for knocking out thousands of prominent websites<\/a>, relied on a botnet of hacked and compromised IoT devices<\/a>.<\/p>\n\n\n\n Eclipse Foundation<\/a> says that nearly half of their respondents (47%) currently deploy IoT solutions connected to their networks, and another 39% plan to follow suit within the next 12-24 months. And considering that every new IoT device represents a new entry point to your network, this means that the more endpoint devices you have, the more exposed your network becomes. <\/p>\n\n\n\n Harriet Chan, co-founder of the software development company CocoFinder<\/a>, emphasizes the importance of protecting every device on your network. Companies must make the effort to secure every endpoint device regardless of how innocuous they may seem:<\/p>\n\n\n\n \u201cIf hacked, even a printer could provide company information to unauthorized personnel. Botnets are mainly used for DDoS Attacks and pose a significant risk if a cybercriminal gains access to connected devices.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Wondering why companies are increasingly relying on these technologies if they pose such big cyber security risks? It\u2019s a fair question, and there\u2019s no single answer. However, many companies either already use or plan to use connected technologies because of their benefits. IoT devices have been known to help organizations in many ways, including:<\/p>\n\n\n\n Connected devices have many potential applications within organizational environments \u2014 their specific usages often depend on the company\u2019s industry. For example, you\u2019ll often find IoT devices in use as:<\/p>\n\n\n\n Internet of Things technologies are becoming increasingly common within business environments. Research from the Eclipse Foundation\u2019s 2021 IoT and Edge Commercial Adoption Survey<\/a> shows that 47% of the 300 IoT and edge professionals who participated currently use IoT within their organizations. Another 39% indicate that they plan to do so within the next 24 months.<\/p>\n\n\n\n Unfortunately, as is common in other areas of cybersecurity, IoT security often gets neglected by the companies who create the devices and the organizations that use them. But for IoT cyber security to be effective, it needs to be a collaborative approach with all parties taking steps to make devices and their uses more secure:<\/p>\n\n\n\n Developers and manufacturers often wear blinders, focusing their attention and efforts primarily on convenience and UX. And we get it \u2014 customers don\u2019t want to buy products that make their jobs harder and are frustrating to use. But with such a narrow DevOps focus, OEMs often wind up sacrificing security in their pursuit of creating the perfect experience.<\/p>\n\n\n\n This is why companies should be adopting a SecDevOps or DevSecOps approach for internet of things security. Basically, the idea here is that cyber security should be a key component of those initial planning, development, and testing processes rather than an afterthought.<\/p>\n\n\n\n There are many reasons why companies don\u2019t have strong IoT security defenses. In some cases, it can be a lack of labor, cyber security budgets, and other resources. Other times, it results from a lack of visibility \u2014 you know, the old \u201cout-of-sight, out-of-mind\u201d issue.<\/p>\n\n\n\n Too often, poor IoT security boils down to:<\/p>\n\n\n\n Of course, simply understanding the reasons or explanations as to why companies aren\u2019t doing what they\u2019re supposed to doesn\u2019t negate or mitigate their damaging effects. Poor IoT security results in everything from non-compliance penalties and lawsuits and lost business and reputational damage.<\/p>\n\n\n\n If companies aren\u2019t investing the time and resources to secure those assets, it creates a substantial attack surface for bad guys to target. This creates the IT and data security equivalent of a buffet for bad guys \u2014 but instead of tasty foods, attackers have a selection of vulnerable devices that provide access to your network and other systems that connect to it, as well as all the sensitive data they contain.<\/p>\n\n\n\n The Internet of Things industry is still relatively new as far as cyber security standards, policies, and regulatory requirements are concerned. But IoT security is an issue that has historically been treated like the proverbial redheaded stepchild \u2014 IT teams and regulators alike have ignored the issues for as long as possible.<\/p>\n\n\n\n This is another factor that has likely had a huge impact on the rise in IoT security threats. It\u2019s also likely why several organizations took the initiative and stepped up to create their own IoT security guidelines:<\/p>\n\n\n\n Thankfully, this \u201cI\u2019m just going to ignore it\u201d mindset demonstrated by governments is slowly starting to change. One of the biggest examples of this evolution can be seen with the passage of the U.S.\u2019s federal IoT security law and the creation of IoT security-related policies and guidelines for federal agencies.<\/p>\n\n\n\n The Internet of Things Cybersecurity Improvement Act of 2020 (H.R. 1668<\/a>) was officially signed into law on Dec. 4, 2020. This legislation requires the Office of Management and Budget (OMB) and the National Institute of Standards and Technology (NIST) to create security policies, standards and guidelines that all U.S. federal agencies (including government departments, contractors and subcontractors) that use IoT devices must adhere to.<\/p>\n\n\n\n Although this law technically only applies to those specified agencies, the guidelines and policies NIST and OMB set forth \u2014 such as NIST\u2019s IR 8259 \u2014 can also serve as resources for private sector organizations and businesses as well. However, there\u2019s no denying that there\u2019s still a long<\/em> way to go in terms of improving IoT cybersecurity as a whole \u2014 particularly with relation to the private sector.<\/p>\n\n\n\n But Jesse Th\u00e9, President & CEO of the B2B SaaS video conferencing solution Tauria<\/a>, says there\u2019s no time like the present to start working on your organization\u2019s IoT security policies.<\/p>\n\n\n\n \u201cEven though a more all-encompassing IoT security policy is awaited, service providers and manufacturers of IoT devices must not wait to start adopting security policies. Rather companies must be enthusiastic about setting standards of market security and IoT compliance. This will help them build brand reputation, ensure consumer safety as well as align product development with emerging standards and get a head start as security standards are implemented.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n The long-standing lack of industry standards and poor IoT security practices makes your network easy prey for cybercriminals. This is great for them but gut-wrenching news for you and your customers.<\/p>\n\n\n\n Speaking of easy prey \u2014 Chris Parker, host of the Easy Prey cybersecurity podcast<\/a> and owner of WhatIsMyIPAddress.com<\/a>, says that IoT security risks relating to widespread device adoption across your network typically are tied to the following:<\/p>\n\n\n\n Adam Kohnke, Information Security Manager at Infosec Institute<\/a>, shares the following concern:<\/p>\n\n\n\n “The network interface provided by IoT devices may provide external internet connectivity to would-be attackers. IoT device manufacturers also typically leave default access credentials in place for the devices they ship. These two conditions together leave enterprises vulnerable and prone to unauthorized remote access attacks.” <\/em><\/p>\n<\/blockquote>\n\n\n\n Once a bad guy compromises a connected device, they can use that access to:<\/p>\n\n\n\n The impact of such attacks and IoT security compromises are devastating. But how is it that these attacks occur? Ryan Nichols, Chief Information Security Officer (CISO) at the payment processing and SaaS company Curbstone<\/a>, says that IoT security often gets overlooked for the sake of convenience.<\/p>\n\n\n\n \u201cWhen it comes to the Internet of Things, out-of-the-box security is often overlooked for convenience. If left unmanaged, IoT devices can present a significant vulnerability to businesses and their data. These devices can be manipulated in a variety of ways, and the vulnerability and risk really [depend] on the device and the deployment.\u201d<\/em> <\/p>\n<\/blockquote>\n\n\n\n We\u2019ll take a more in-depth look at IoT security issues, risks and challenges in another IoT-related article. Be sure to check back with Hashed Out over the next few weeks to see when content becomes available.<\/p>\n\n\n\n In the meantime, let\u2019s explore ways you can effectively manage your network\u2019s IoT security.<\/p>\n\n\n\n Parker says the effectiveness of IoT security management is finding ways to meet your organization\u2019s safety and performance needs within the confines of your financial limitations. Ask yourself important questions: Do you have the in-house skills, knowledge, and tools to meet these network and IoT security needs on your own? Or would it be more beneficial to explore the option of outsourcing network management to an MSP?<\/p>\n\n\n\n For people who want to handle this responsibility on their own, Nelson says that using an IoT management platform can help:<\/p>\n\n\n\n \u201cIoT management platforms are a great way to maintain control of a growing IoT environment. Management platforms should have the ability to manage and push out device updates, identity vulnerabilities, have device level visibility, generate reports on devices, and help with the overall lifecycle management of a device.\u201d <\/em><\/p>\n<\/blockquote>\n\n\n\n When choosing how you want to manage internet of things security and access across your network, one of the biggest decisions you\u2019ll need to make is whether to use a centralized or decentralized approach.<\/p>\n\n\n\n There are some advantages to using a centralized approach to IoT security management \u2014 one being that it\u2019s safer overall. Another advantage is that using a centralized management tool is that you have greater visibility of all your networks\u2019 devices so your devices don\u2019t fall between the cracks and become forgotten. However, there are also some advantages of using a decentralized system as well \u2014 improving performance by distributing processes and eliminating single points of failure that you may find in some centralized systems.<\/p>\n\n\n\n Alex Feiszli, CEO of the next-gen cloud solutions startup GRAVITL<\/a>, approaches the topic from a different perspective. He says that using both approaches is ideal for IoT security management:<\/p>\n\n\n\n \u201cThe array of IoT devices has become so large and complex that a centralized approach is extremely difficult to implement effectively. Still, centralized tools are necessary to help to pinpoint threats in real time. Decentralized approaches like zero-trust networking make sure all devices start with the minimal possible permissions. If you have to choose just one, go with decentralized. But don\u2019t do that, do both.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Regardless of which approach you implement, DigiCert\u2019s Nelson says to make sure it\u2019s the right one for your business:<\/p>\n\n\n\n \u201cThe answer to whether a centralized or decentralized approach is best comes down to the business needs and requirements. Both approaches can work and be effectively deployed \u2013 organizations need to make the decision that is best for them.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n But in addition to using an IoT management platform, what else can businesses do to secure their IoT devices and their connected network environments?<\/p>\n\n\n\n Our group of experts contributed to the following list of practical steps businesses and other organizations can take to secure their IoT devices, networks, and data:<\/p>\n\n\n\n It seems like everyone and their brother are coming out with their own smart technology products. This saturation of devices in the market doesn\u2019t mean that the companies are putting in the time and effort to make their devices as secure as possible.<\/p>\n\n\n\n Kohnke says that effective IoT management requires due diligence and research up front.<\/p>\n\n\n\n \u201cIoT Device management starts with a thorough review and vendor analysis for any third party that may supply IoT devices to the enterprise, which also includes a review, to the extent possible, of the components used on the devices themselves. If a vendor review passes and devices are purchased, a security assessment should be conducted against each device to change default usernames, passwords or other default configurations to the most secure settings possible.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n Part of this entails verifying that a manufacturer integrates adequate security measures into their IoT products and provides ongoing updates and support. But if there\u2019s something you don\u2019t like or seems inadequate, Kohnke emphasizes the following: \u201cDon\u2019t be afraid to leave unsecure or shady vendors. If they cannot explain or provide easy to understand security processes to help perpetuate security, find someone who can.\u201d<\/em><\/p>\n\n\n\n We mentioned some cyber security and IoT security-related frameworks earlier that you can adopt or adapt for use within your organization. However, implementing certain security best practices is critical to securing your networks and the devices that connect to them.<\/p>\n\n\n\n Here are a few best practices that you can implement right away to make your IoT network more secure:<\/p>\n\n\n\n All organizations, small businesses and large enterprises alike, should have documented cyber security policies and procedures in place. But what good do those policies and procedural guides do if you never bother to enforce them?<\/p>\n\n\n\n Chan says that enforcing these internal IoT and cyber security regulations with infractions is necessary to get users to take the initiatives seriously. After all, if users don\u2019t have any skin in the game or they know that they won\u2019t face repercussions for violating your security policies, then your security rules are like having a guard dog with no teeth.<\/p>\n\n\n\n Having documented policies and procedures in place includes having plans and procedures for your organization\u2019s business continuity and disaster recovery initiatives. It also means being ready when other types of unforeseen situations occur.<\/p>\n\n\n\n In addition to this, Tom Van de Wiele, Principal Security Consultant at the cyber security vendor F-Secure<\/a>, brings up another important point to consider:<\/p>\n\n\n\n \u201cMake sure your business has the contingencies in place to operate without the IoT service. Not just when it comes to the availability of the service, or lack thereof, but also when it comes to the health of the supplier. \u2018Life time support\u2019 of the device and services doesn\u2019t deal with your life, or the product\u2019s life; it is the life of the company offering the technology or services\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\n One of the best ways to mitigate the risks associated with having connected devices on your main network is to not have them on there at all. Sound counterintuitive? Not really \u2014 you can isolate your IoT devices from your critical business networks and applications by simply connecting them to a separate, dedicated network. This is something that the overwhelming majority of our experts recommend.<\/p>\n\n\n\n Van de Wiele shares the following about the broad attack surfaces IoT represents for many businesses:<\/p>\n\n\n\n \u201cWhen considering IoT technologies used in the workplace, the biggest risks are not adequately separating the IoT technology from business-critical networks \u2014 and, thus, adding to the general attack surface, e.g., shared networks and infrastructure. [\u2026]<\/em><\/p>\n\n\n\n Most IoT compromises that have been published have caught the attention of the media because, far too often, critical business networks end up in the blast radius of a compromised remote management service or hacked IoT technology stack.\u201d<\/em><\/p>\n<\/blockquote>\n\n\n\nWhat Is IoT Security? What It Means to Secure These Emerging Technologies<\/h2>\n\n\n
![\"IoT](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/08\/iot-market-growth-fortune-business-insights.png\")
\n
Why IoT Security Matters<\/h3>\n\n\n\n
\n
Your IoT Devices and Network Are Only As Secure as Your Smallest Vulnerability\u2026<\/h4>\n\n\n\n
\n
How and Why Businesses Globally Use IoT Within Their Environments<\/h2>\n\n\n\n
\n
\n
Why Enterprise IoT Is a Vulnerable (and Growing) Attack Surface<\/h2>\n\n\n
![\"\"](\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2021\/08\/enterprise-iot-deployment-examples.png\")
\n
Where OEMs Fall Short Regarding IoT Security<\/h3>\n\n\n\n
Why End User Companies\u2019 Efforts Are Often Lacking<\/h3>\n\n\n\n
\n
IoT Security Regulations and Laws Historically Have Been Virtually Non-Existent<\/h3>\n\n\n\n
\n
The U.S. Introduced the First IoT Security Law in 2020<\/h4>\n\n\n\n
\n
Examples of IoT Security Risks<\/h2>\n\n\n\n
\n
\n
\n
\n
One of the Biggest Issues in IoT Security? Complacency<\/h3>\n\n\n\n
\n
Managing IoT Security: Determine What Your Needs Are & How Best to Meet Them<\/h2>\n\n\n\n
\n
Centralized vs Decentralized IoT Security: Which Approach Is \u201cBetter\u201d and Why?<\/h3>\n\n\n\n
\n
\n
10 Steps Businesses Can Take to Increase Their IoT Security<\/h2>\n\n\n\n
1. Only Use IoT Products from Reliable Vendors<\/h3>\n\n\n\n
\n
2. Implement Cyber Security Frameworks and Follow IoT Security Best Practices<\/h3>\n\n\n\n
\n
3. Document and Enforce Internal IoT and Cyber Security Policies and Procedures<\/h3>\n\n\n\n
Prepare for When Things Go Wrong<\/h4>\n\n\n\n
\n
4. Use Dedicated Networks for Access By Different Devices<\/h3>\n\n\n\n
\n