The Internet of Things (IoT) market is booming. Gartner predicts that 5.8 billion IoT endpoints will be in use in 2020, marking a year-over-year growth rate of over 20% since 2016. While IoT devices undoubtedly make life more convenient, they also present an expanding attack surface as a means of network infiltration. Recent reports suggest that IoT devices have become a primary target with attacks on IoT devices up 300% in the first half of 2019. Given these developments, IoT security has become a hot topic.
Read moreCategory: IoT
Protecting your network from IoT peer-to-peer vulnerabilities
In a recent article on Dark Reading, it was revealed that millions of IoT devices were exposed to a peer-to-peer (P2P) vulnerability. Given how wide-spread IoT devices are, and how device adoption will continue in organizations, it is important to understand the nature of these devices and how organizations can prevent these vulnerabilities from becoming backdoors into the corporate network. Specifically, let’s take a look at how businesses can protect themselves from P2P and IoT vulnerabilities.
Creating a secure IoT environment
With global IoT product adoption continuing to grow, many organizations are trying to tackle the challenge of allowing these devices in while maintaining a strong security posture for the business. How businesses do this varies, but there is some good news for IoT aficionados who hope to deploy some new tech to make their jobs easier.
The dangers of IoT devices and what you should know
IoT devices are dangerous! Now, I know what you are thinking, “Justin, IoT devices provide convenience and make many mundane parts of life so much more interesting.” Consider, however, that many of the IoT devices on the market are designed with little care or interest in security. So, what should be considered before you bring a shiny new IoT device onto your network? Let’s explore.
IoT checklist—what to consider before you deploy
IoT devices are one of the most vulnerable devices that can be deployed on a network. They are usually put on the network as trusted devices, are rarely updated—if updates are even an option for the device—and are built to be deployed quickly, so security is often an afterthought. Because of this, IoT devices are extremely vulnerable to attack, and malicious actors love when IT professionals deploy them on corporate networks. After a short period, the devices remain without updates, and hackers exploit known vulnerabilities.
Because these devices are on the network, often with full access to many or all shared resources, the hackers begin their assault. The IoT devices have become the proverbial Trojan Horse, and the IT team has walked it right into the network.
When you are looking for a connected device that will solve a problem—let’s say connected locks that allow employees to use an app to gain access to a part of the building—you need to be certain of a few things. Namely, you need to understand if the devices are capable of firmware and software updates. Should a vulnerability be exposed, you need to have a way to update devices. Talk about the irony of your connected locks being the key to your entire network. Additionally, you must understand the security built into the devices. Are all communications over a secure, TLS channel? Does that encryption use industry standards with appropriate key sizes? While some of this information will be difficult to understand before purchase, it is certainly something you can find out by deploying a test device in a lab to understand the communications it has. This is an important step to understanding if deploying the device is relatively safe or if the device will become that Trojan horse.
Deployment guide
Okay, you now know how bad IoT devices are, and you understand that malicious actors will use these devices as much as possible to wreak havoc on your network. You also understand some of the security features built into the devices, and you want to deploy the device on the network. Now what?
IoT devices still should not be trusted. They need to be in isolation as much as possible, with only critical connections allowed. Additionally, they need to be monitored. Network traffic analytics is the best, first step to understanding what these devices are doing, and when they are compromised provides an effective way to find where hackers are trying to gain access. Network traffic analytics allows for scoring and monitoring of these devices at all times. According to Barracuda Networks, “IoT products should be scored constantly, and their security posture be published in the same way as motor vehicle safety ratings are, to enable businesses and consumers to make informed decisions when choosing products.”
To fully understand what your IoT devices are doing on your network, download a free trial of Scrutinizer today.
IoT in Healthcare: Managing The Opportunity & The Risk
It’s an exciting time in medicine. Technology is constantly making healthcare more accessible, more precise, and more convenient. For instance, IoT in healthcare can increase hospitals’ efficiency in many ways. But you should also be prepared for the risks it brings.
How to reduce your IoT threat surface
Recently, there has been an increase in distributed denial-of-service (DDoS) attacks that involve the use of compromised IoT devices like IP cameras, and it is extremely common today for organizations and consumers to purchase IoT devices. So how can organizations reduce the IoT threat surface that these devices bring, and how can they see what these devices are doing?
Reduce the number of IoT devices on your network
While this may sound like an obvious solution, it’s likely not something you’ve considered given the availability of these devices in the market. But have you considered alternatives, or have you considered abandoning the purchase all together? Sure, that IP camera setup is extremely easy and doesn’t require you to drill holes, but connecting it to your corporate Wi-Fi may not make the most sense. Many hardwired versions of popular IoT devices are available and can provide similar functionality without the added risk associated with them.
Isolate the devices
Okay, so you must have that IoT coffee bar with built-in voice control to create that perfect cappuccino in the morning. But you don’t have to add it to the corporate network to use its internet-enabled features. When you have a device that requires internet connectivity, deploy the device on a guest network instead of the main, corporate network. This setup will allow the device to connect to the internet for updates and to retrieve those updated macchiato recipes you so desperately desire, but will keep the devices from connecting to business-critical applications and wreaking havoc on your corporate assets. We know you must have your iced quad upside-down caramel macchiato with light ice, but let’s make that possible while reducing the threat surface.
Deploy devices with least privileges
So your coffee bar might be something you can get away with putting on a separate, isolated network, but some devices might require connecting to an application or server on the main network. Fret not; it is still possible to deploy the IoT device on the corporate network without adding too much risk (risk is always possible when deploying any device).
When deploying IoT devices on the main network, they should always be deployed with a least-privilege approach. This means that you will deploy the device on the network, but the device will be locked down from communicating to everything that isn’t absolutely required.
Imagine you are deploying a new IP camera system that connects to the internet to provide DVR-like functionality. This new system will likely have a central storage server (either on the local network or online) where the individual cameras connect. In this setup, the IoT system is very limited in its requirements. Specifically, the individual cameras only need to communicate to the local, internal server for storing the video, or a limited set of connections to the internet (a range of IP addresses or hostnames where the internet server is located). Because of this, you can fairly easily limit the communications from the cameras by creating an ACL for these IP cameras and allow connections to the limited number of devices required to record and store the necessary video effectively.
Monitor IoT devices for anomalous behavior
If you are going to deploy IoT devices on your network, you need to monitor the traffic that these devices are generating. While ACLs are an important step in a multi-layered approach to network security, you must have a way to detect and alert on breaches to these policies. When the IP camera starts to communicate to the mail server or attempts to access your financial documents, a red flag should immediately be raised because, after all, these devices are purpose-built and have no viable reason to communicate with these servers or applications.
By having the insight on these IoT devices, you can reduce your IoT threat surface while still maintaining the convenience and improved performance that these devices provide.
If you would like to learn more about monitoring IoT devices on your network and leveraging network traffic analytics to see when they are communicating with device unrelated to their function, download Scrutinizer today; our team will help you get set up.
IoT Security: The Nightmare After Christmas
What’s this? What’s this? There’s IoT devices everywhere!
IoT Security Trends & Challenges
Before you read this blog, stop and count every electronic device around you. I’m at my work desk; within a 1-meter radius, I have ten electronic devices. In a few years, if I replaced each item with freshly launched products, at least nine of those devices would contain IoT technology.
Using NetFlow and Metadata Analysis to Reduce IoT Security Risks
The Internet of Things (IoT) describes the wide array of devices (beyond traditional computers and mobile phones) that are today, or will be in the future, connected to the internet. According to Gartner, there will be 20.4 billion connected devices by 2020. These internet-connected devices provide valuable functions that make people’s lives easier and improve business outcomes; however, there is a dark side. IoT devices expose new attack surfaces and introduce a vast number of security vulnerabilities. As such, IoT security must quickly become a top priority for IT. Collecting, visualizing, and reporting on IoT device flow data is an extremely effective mechanism for reducing security risks associated with IoT devices. Flow data can be analyzed to look for anomalous behavior that is caused by a breach.
IoT Security with NetFlow/IPFIX
With billions of devices coming online yearly, the world of IoT (Internet of Things) is upon us. Unfortunately, like any new technology, form and function greatly outweigh security, leaving businesses and individuals exposed. Due to this general disregard early on, IoT security with NetFlow is quickly becoming a focus and pushing companies into better monitoring practices.
