Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

8/12/2019
10:00 AM
Prabhuram Mohan
Prabhuram Mohan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
100%
0%

6 Security Considerations for Wrangling IoT

The Internet of Things isn't going away, so it's important to be aware of the technology's potential pitfalls.

The year 2020 is fast approaching, and studies estimate that more than 10 billion Internet of Things (IoT) devices will be connected by then. As the number of devices continues to grow, we're putting ourselves at greater security risk. But despite the vulnerabilities, the general public keeps using and purchasing new devices and has come to have blind trust in them.

According to SAM Seamless Networks, security cameras make up nearly half of the most vulnerable devices, followed by smart home devices Google Home and Amazon Alexa. And vulnerabilities are not just in our homes — the enterprise is at risk also.

The Mirai botnet attacks are still being used to damage corporate networks. Recently, a new IoT bricking worm, malware dubbed Silex, has been hitting Linux-based devices, and it's designed to permanently disable the hardware it infects, effectively rendering the devices useless.

What Makes IoT So Vulnerable?
The sheer increase in the volume of consumer IoT fostered by retail and tech giants has created a massive attack surface. Consumers may have dozens of IoT devices in their homes. And with all of their variations in software, suppliers, and connection points, the possibilities for things to go wrong seem endless.

For instance, the simple task of turning on your home security system (an IoT device that communicates with a server), driving your car (your phone or car could also be an IoT device), and using a streaming camera at home seems innocuous on their own, but the data may be tracked by various parties, and combining them causes alarming possibilities of potential malicious activity.

To better ensure safety and security, education is needed across the entire IoT ecosystem — from consumers to device manufacturers, service providers, third parties, and developers. Findings show the top reasons for IoT security vulnerabilities include weak passwords, insecure web APIs, cloud and mobile interfaces, insecure third parties, network services, and data transfer to name a few.

What Can Be Done?
Security is only as strong as your weakest link, and we all need to be a bit paranoid in order to get better and for changes to take place. Below are a few considerations to build stronger IoT security:

1. Team mindset: For security to become a priority, it helps to have an entire team that is invested in security. This includes everyone from the CEO and website manager to the developer. When teams and priorities are aligned, budgets and actions are built into short- and long-term goals.

2. Standardization: IoT industry standardization is needed across the board — much like the standards for browsers and websites in the early days of the Internet. Web browsers and websites have evolved a lot over the years, and we are very much in the early stages of IoT.

3. Secure the supply chain: We must hold vendors accountable, but it's not just about the device itself — supply chain partners are numerous. As we saw with Google Home Nest cameras, third-party service providers were part of the problem that allowed old owners of cameras to spy on new owners.

4. Consumer education: If more people are educated on what could go wrong, they will be more security conscious. If they're aware of vulnerabilities and issues, they can help prevent attacks. For example, as we saw with the Nest vulnerability, they can make sure their devices are set to factory settings and check for updates to systems on a frequent basis. Educating kids at an early age can also go a long way, just like they're told to not open the door to strangers. In our modern age, "safety" is still the issue, but the risks have changed. The simple task of installing an application off the Web itself can become the weakest link.

5. Secure applications that support IoT devices: We must ensure that the code and software we build for IoT is continually tested for vulnerabilities. For instance, we can pre-emptively change default passwords of devices, and also manage the patch level of the kernel software on devices to prevent exploitation of new vulnerabilities.

6. Multilayered network security: Many things can be done at the enterprise network level. Segmentation of networks can ensure that hacked IoT devices can't affect other areas of networks. Perimeter security can help ensure hackers can't see networks in the first place. Companies should also limit the ability of IoT devices to initiate network connections.

IoT is certainly the Wild West in technology right now, but if we recognize IoT is not going away, and acknowledge its vulnerabilities do create real life safety issues for us, we can raise the awareness, work together across the different layers, and take steps to secure them.

Related Content:

 

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Prabhu Mohan is a software development leader and innovator with over 20 years of product development and execution expertise covering a wide range of technologies and industry verticals spanning from application security and embedded mobile applications used on millions of ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Tor Weaponized to Steal Bitcoin
Dark Reading Staff 10/18/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-9501
PUBLISHED: 2019-10-22
The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.
CVE-2019-16971
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\messages\messages_thread.php uses an unsanitized "contact_uuid" variable coming from the URL, which is reflected on 3 occasions in HTML, leading to XSS.
CVE-2019-16972
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\contacts\contact_addresses.php uses an unsanitized "id" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2019-16973
PUBLISHED: 2019-10-22
In FusionPBX up to 4.5.7, the file app\contacts\contact_edit.php uses an unsanitized "query_string" variable coming from the URL, which is reflected in HTML, leading to XSS.
CVE-2015-9496
PUBLISHED: 2019-10-22
The freshmail-newsletter plugin before 1.6 for WordPress has shortcode.php SQL Injection via the 'FM_form id=' substring.