Vulnerabilities / Threats

SMBs Practice Better IoT Security Than Large Enterprises Do

Small-to midsized businesses are more prepared than big ones to face the next IoT attack: good news given the sharp rise in IoT botnet attacks in the first half of 2017, new reports released today show.

Massive IoT botnet Mirai helped fuel a 280% rise in telnet botnet attack activity in the first half of the year over the previous period, but small-to midsized (SMB) business are surprisingly better prepared to deal with IoT threats in general than large enterprises, according to data from separate IoT reports released today.

In its survey of 950 IT professionals from SMBs to large enterprises, Pwnie Express found SMBs check their wireless devices for malicious infections and their employees' BYOD devices for malicious infections with greater frequency than large enterprises.

Some 64% of SMBs checked their wireless devices for infections in the last month, compared to 55% of large enterprises. Nearly one-third of SMBs reviewed employees' BYOD devices for malware in the previous month, compared with 20% of large companies. 

These steps not only help address IoT security in general, but may also aid in preventing SMB IoT devices from getting infected and becoming part of a bot army.  

According to F5 Labs' new report on botnets, not only was there a dramatic three-digit rise in botnet activity in the first half of the year, but most of that movement happened in the first two months. It has been much quieter since then, and F5 believes attackers may have completed their reconnaissance of vulnerable IoT devices and are now the process of potentially building massive botnets.

"We are seeing just the tip of the iceberg" for IoT botnets, says Sara Boddy, F5 Labs lead and author of the company's report, 2017 Rise of the Thingbots.

Approximately two years ago, telnet brute-force attacks were rather uncommon, she says. But with the rising popularity of IoT devices, which typically use the telnet protocol and Port 23 to allow remote administration of the device, Boddy says she expects to see a wide swath of IoT devices hijacked into botnet armies by way of the telnet protocol.

"A lot of IoT devices use Port 23 because when they were designed, no one ever thought a parking meter, teddy bear, or TV would be attacked," Boddy explains.

She adds that telnet-enabled IoT devices are not only easy to attack but they are also a cost-effective means for building a botnet army. IoT devices usually don't have security features in them and may require little direct user interaction like a remotely controlled thermostat, Boddy says. As a result, an attacker has a good chance of keeping an IoT-infected device alive, compared to Grandma's infected computer that gets fixed and then the attacker loses a bot, she notes.

Meanwhile, the pool of potential botnet army targets is expected soar. Gartner is forecasting a 31% year-over-year jump in the number of IoT devices by the end of the year to 8.4 billion.

Businesses with IoT devices running on their networks should take precautions to avoid a DDoS attack by using or having a scrubbing service on call that can handle an onslaught of at least 1 terabyte per second, Boddy suggests.

She also advises organizations to run Web Application Firewalls (WAFs), along with ID access and management tools with single-sign on, and two-factor authentication to help with credential stuffing.

When it comes to SMBs, Boddy says it's important to have a DDoS solution, in addition to other tools to plug the main vectors of attack. "Sometimes these things are cost prohibitive, but at least they should be aware of their known threat gaps," she says.

However, SMBs, generally have smaller security teams and might not have the resources necessary to deal with the IoT threat potential, she notes.

Some Props for SMB IoT Security 

The Pwnie Express, however, has a different assessment of SMBs. Pwnie's report, "Is Bigger Better? How Small & Midsized Organizations Are Better at Closing the IoT Security Gap,"  found 62% of SMBs know how many IoT devices are connected to their network, compared to 47% of large companies.  

Although it stands to reason SMBs may have a better handle on the number of IoT devices on their networks because there are fewer of them compared to large enterprises, there is another more significant reason at play, says Dimitri Vlachos, Pwnie's vice president of marketing.

"Large companies have silos, so when you see an adoption of new technology, the IT department is not always told. But at SMBs, IT departments tend to hear about it because the organizations tend to be flatter," Vlachos says.

SMBs have also been known to involve IT security at their companies when considering new hardware and software to purchase, says Yolanda Smith, Pwnie's director of product management.

Meanwhile, SMBs also tend take responsibility for the IT security of employees' BYOD devices, whereas large corporations maintain more of a hands-off approach, Vlachos says.

Small companies may find the need to be more proactive with an employee's IoT device because a security breach can be far more devastating to a mom-and-pop operation than a Fortune 500 company with deep pockets, he adds.

Although SMBs are more prepared to deal with IoT security, it does not necessarily translate into their ability to fend off a massive DDoS attack. And Vlachos says SBMs are not usually the target of a DDoS attack, anyway.

Related Content:

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-6345
PUBLISHED: 2019-01-15
The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal implementation of the function will cause a string to be created with an invalid length, which can then interact poorly with other functions. This affects all s...
CVE-2018-7603
PUBLISHED: 2019-01-15
In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes, comments, etc.). The module doesn't sufficiently filter user-entered t...
CVE-2019-3554
PUBLISHED: 2019-01-15
Wangle's AcceptRoutingHandler incorrectly casts a socket when accepting a TLS 1.3 connection, leading to a potential denial of service attack against systems accepting such connections. This affects versions of Wangle prior to v2019.01.14.00
CVE-2019-3557
PUBLISHED: 2019-01-15
The implementations of streams for bz2 and php://output improperly implemented their readImpl functions, returning -1 consistently. This behavior caused some stream functions, such as stream_get_line, to trigger an out-of-bounds read when operating on such malformed streams. The implementations were...
CVE-2019-0030
PUBLISHED: 2019-01-15
Juniper ATP uses DES and a hardcoded salt for password hashing, allowing for trivial de-hashing of the password file contents. This issue affects Juniper ATP 5.0 versions prior to 5.0.3.