Endpoint

1/4/2018
10:30 AM
Rinki Sethi
Rinki Sethi
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

The Internet of (Secure) Things Checklist

Insecure devices put your company at jeopardy. Use this checklist to stay safer.

In October 2016, as a botnet strung together by the Mirai malware launched the biggest distributed denial-of-service attack in history, I was, appropriately enough, giving a talk on Internet of Things (IoT) security and privacy at the Grace Hopper Conference. As I learned of the attack, and as questions came in from the audience about the malware, I knew that the topic of my session could not have been more timely. In this instance, and in countless others, IoT security is a core issue. Security professionals need to be concerned about insecure devices.

More than a year later, IoT continues to be a growing concern. From Internet-connected toaster ovens to smart hairbrushes to popular health trackers, these devices can be risky, especially when used in certain environments. Given the prevalence of these devices coming in and out of corporate networks, not only is it important to be ready to protect your own organization, but it is crucial to understand how far IoT risk can extend. 

As the AT&T IoT Cybersecurity Alliance highlighted in a recent white paper, Mirai was a prime example of the type of risk posed by unsecured IoT devices. The obvious threat is exposure of personal data to an attacker who compromises a device. However, according to the report, if the connected devices within your organization are used as part of a widespread attack, your organization could suffer reputational damage or, worse, your organization could be victimized by a compromised IoT device from a business partner.

Just like any type of cyberattack, the implications of an IoT attack are far-reaching. This is why it is important for security professionals to approach IoT security just as they would network, endpoint, and cloud security. A comprehensive cyber hygiene strategy is a necessary component of securing your organization and preventing cyber attacks.

Security teams should review their current priorities and reference this basic IoT security hygiene checklist:

  1. Assess your company's overall risk acceptance. Every company has a different view of the types of risks they are willing to accept, and it's critical you understand your company's overall risk acceptance. This is an important first step, as it will help you determine which devices you will allow to connect and which devices you will need to block. For example, some companies may find it to be low-risk if users connect health-tracking devices to company laptops, allowing them to transfer personal health data. Other companies with a different security posture may find this to be a high risk.
  2. Develop an IoT awareness and training program.  Employees need to be aware of the risk that connected devices present. In order for them to be IoT savvy, they need proper resources and training. An integral part of developing their awareness is making sure they understand how their personal devices are part of the bigger picture and overall security of their workplace — and what is allowed and what is not. Training also should include how to do IoT health checks to determine if devices are secure. It is important to provide employees with the tools needed to protect themselves and the organization, whether that means a required course on IoT risk and cyber hygiene or a video starring the executive staff that demonstrates possible IoT threat scenarios.
  3. Practice what you preach. A personal device hygiene check is always a good reminder about the importance of IoT security. Going through this process yourself will help you figure out what should be included in your company's IoT hygiene program. I make a habit of regularly checking through the apps on my phone to see what access they have. Many devices request access to photos, location information, and contacts; ask yourself if you want to allow this. Keeping IoT devices up to date and ensuring the proper privacy settings are in place are important steps for securing your own device and for securing the networks and other devices that they connect to, including company laptops and mobile phones.

Gartner predicts that more than 20 billion connected devices will be in operation by 2020, rising from 8.4 billion in 2017. The security investments made by companies creating these billions of devices are just as diverse as the devices themselves. There are some IoT companies investing in a lot in security, while others are focusing only on creating connected devices — and security may be an afterthought. As security practitioners, we should take this into consideration when assessing IoT risk for our organizations and users. There is a lot we can do to ensure we are one step ahead when it comes to IoT security.

Related Content:

Rinki Sethi is Senior Director of Security Operations and Strategy at Palo Alto Networks. She is responsible for building a world-class security operations center that includes capabilities such as threat management, security monitoring, and threat intelligence. Rinki is also ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lee337w
50%
50%
lee337w,
User Rank: Apprentice
1/5/2018 | 4:31:06 PM
New Devices, same rules
Great post on how the same security hygiene techniques will help combat the IoT security challenges. Many people think compeltely new paradigms are needed, but it really comes down to tried and true practices and controls to help create and maintain secure environments. Great Article
mrgorle@yahoo.com
50%
50%
[email protected],
User Rank: Apprentice
1/5/2018 | 2:53:51 PM
Very informative and detailed
This is very informative and detailed article. Thanks.
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
The Fundamental Flaw in Security Awareness Programs
Ira Winkler, CISSP, President, Secure Mentem,  7/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14492
PUBLISHED: 2018-07-21
Tenda AC7 through V15.03.06.44_CN, AC9 through V15.03.05.19(6318)_CN, and AC10 through V15.03.06.23_CN devices have a Stack-based Buffer Overflow via a long limitSpeed or limitSpeedup parameter to an unspecified /goform URI.
CVE-2018-3770
PUBLISHED: 2018-07-20
A path traversal exists in markdown-pdf version <9.0.0 that allows a user to insert a malicious html code that can result in reading the local files.
CVE-2018-3771
PUBLISHED: 2018-07-20
An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.
CVE-2018-5065
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have a Use-after-free vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.
CVE-2018-5066
PUBLISHED: 2018-07-20
Adobe Acrobat and Reader 2018.011.20040 and earlier, 2017.011.30080 and earlier, and 2015.006.30418 and earlier versions have an Out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.