IoT Security: Top Ten Ways to Secure Your Organization

Comments · 23 Views

Imagine giving everyone the ability to remotely access data at your company or to operate computers, machinery, and equipment. Now consider the fact that the larger Internet of Things, or IoT, connects billions of commercial gadgets, ranging from simple security cameras, barcode scanners,

This enormous network is made up of unrelated computers and computing tools that exchange data without computer-to-computer or person-to-person communication. In addition, a rising number of designers and producers are incorporating smart technology into their goods in response to consumer demand for simple data access, management, and tracking from any location utilising any desktop computer, portable laptop, or mobile phone.

The banking, energy, government, and utilities sectors all have smart devices in place to assist organisations reduce operating costs, increase productivity, improve customer experience, raise workplace safety, and mobilise workers. Everyone, from local small businesses to large corporations, is reaping the rewards. 

The patient experience in the medical and healthcare fields has already undergone a transformation. IoT has enhanced traffic flow and vehicle safety in transportation systems, and it has made it possible to analyse statistical data and regulate processes in manufacturing sectors.

But like most technological advancements, IoT adds a new level of company risk. This is due to the fact that smart devices, which include both company-controlled equipment and small, seemingly harmless gadgets carried to the job site every day by staff and contractors, expose a network to potential access.

The IoT Security Landscape

According to a poll done by Tripwire in 2017 in collaboration with Dimensional Research, 96% of respondents for whom digital security was an important aspect of their employment anticipated an increase in Industrial Internet of Things, or IIoT, security assaults. Organizations are investing more extensively on IoT security technology, whether at the network level or in the form of IoT authentication like digital certificates, two-factor authentication, and biometrics, as a result of this and regulatory mandates. 

Another tactic that businesses may employ to preserve data integrity and IoT device security is data encryption. PKI, security analytics, and IoT API security are also developing as effective choices for identifying and blocking breaches.

The necessity for IoT security and the inherent danger associated with using smart technology first became apparent in 2014 with the Stuxnet attack, which targeted industrial programmable logic controllers, or PLCs. It was claimed that this was done in an effort to harm an Iranian facility for uranium enrichment. In the end, Stuxnet eliminated up to 1,000 centrifuges. 

A few years later, in 2016, cybercriminals carried out a DDoS attack in Finland by taking advantage of a weakness in an organisation's IoT security. As a result, the heating systems in two buildings were shut down, which was harmful given the country's extreme cold.

Peer-to-peer communications technology, which lacks encryption and authentication and is installed in millions of consumer electronics devices and security cameras, enables thieves to establish a direct link and get over firewall constraints, according to recent study.

Top IoT Security Risks

In contrast to traditional networks, the Internet of Things (IoT) is made up of billions of autonomous devices, each offering its own set of capabilities, standards, and protocols. This might make security much more difficult.

IoT gadgets have thus evolved into desirable hangouts for fraudsters wanting to obtain private information, disrupt operations, or create botnets. For instance, a hacker may gain access to a simple office printer and read any documents that were scanned or printed using that device. A connection to the company network can also be provided by a smart printer, thermostat, or security camera, potentially revealing a wealth of confidential information.

Once compromised, the device's activities can be managed remotely, giving a cybercriminal the power to disrupt vital equipment used in everyday operations, such as assembly lines, or even stop a building's heating system.

The proliferation of botnets, which are vast networks of infected devices used to launch Distributed Denial of Service, or DDoS, attacks against servers by flooding them with more requests than they can reasonably handle in a given amount of time in an effort to bring them down, has shown that IoT devices are also lucrative targets for hackers. Beyond this, smart devices serve as entry points for malware infection or eavesdropping, with hackers frequently demanding ransom payments before allowing a business to resume regular operations.

While device designers play a role in some IoT security breaches, users must also take precautions to secure their IoT devices after they are connected to the network. What measures may a company then take to stop a takedown or data breach? Here are our top ten tips for striking a balance between IoT security requirements and the natural advantages of smart technology.

Top Ten IoT Security Strategies

 

Change default passwords. 

The initial step to enhancing IoT security may seem obvious. However, in our work as security experts, we frequently encounter default passwords. We advise firms to set up and implement policies that require all IoT devices connected to the network to have their default passwords changed. Over time, the revised passwords should be changed. 

The credentials can be kept secure by being kept in a password vault, just like service accounts and privileged user passwords are. This can assist in closing that network backdoor and prevent unauthorised individuals from accessing sensitive data.

Separate the corporate network. 

Whenever possible, keep vendor-managed and unmanaged IoT devices apart from the corporate network. HVAC systems, security cameras, thermostats, electronic billboards, smart televisions, media centres, security DVRs and NVRs, network-connected clocks, and network-connected lighting may fall under this category. 

Use VLANs to handle critical activities including facility operations, security operations, and medical equipment as well as to separate and keep track of various IoT devices on the network. Last but not least, wherever possible, add an Access Control List, or ACL, to VLANs or network access ports to restrict communication to the minimal amount necessary for device operation.

Prevent IoT devices from communicating with the internet unless absolutely necessary. 

Numerous devices use outdated operating systems, and numerous embedded operating systems allow communication with command and control centres. We've even encountered systems that were infected before they were imported from abroad. IoT devices can't be totally stopped from posing a security risk, but you can stop them from talking with other networks unless it is absolutely necessary. By doing this, a possible backdoor into your network can be sealed, significantly lowering the probability of an IoT security breach on average.

Control which vendors are allowed remote access to IoT devices. 

Businesses can implement controls to limit the number of vendors allowed remote access to IoT devices in order to increase IoT security. Access can be restricted to those executing duties under the guidance of skilled staff, and may even include remote access via WebEx. If remote access is absolutely required, make sure the vendors utilise the same tools as internal staff. This can involve using the company's VPN service.

Additionally, businesses should select a staff member to be in charge of daily remote access solution monitoring. This includes tracing any modifications to a change management request that has been accepted. If suppliers are required to access the network, regular vendor due diligence and risk checks are crucial. Examine any strange remote login behaviour, such as logins made outside of business hours or failed login attempts, lastly. All remote access should, if at all possible, be restricted and managed.

Implement a Network Access Control (NAC) solution. 

By recognising the majority of devices and identifying unauthorised connections to the network, a NAC solution with suitable switch and wireless integrations can assist an organisation in enhancing IoT security. Additionally, it has the ability to impose restrictions on equipment with no authorization or with only restricted access to the network. 

A reliable network scanning tool or vulnerability scanner can be used to find devices if a NAC solution is not financially feasible. It is simpler to impose manual limits on the switch ports and wireless controllers where devices may be attached when personnel in charge of IoT security within an organisation are aware of where each device is placed. When considering choices to safeguard your network, a NAC solution like ForeScout, CISCO ISE, or Aruba ClearPass are excellent resources.

Implement a vulnerability scanner as soon as possible. 

Commercial vulnerability scanners are helpful tools for businesses trying to improve their IoT security since they are efficient at identifying the different sorts of connected devices. For businesses wishing to regulate their IoT environment, using a vulnerability scanner in conjunction with a regular scanning schedule can reveal known vulnerabilities related to connected devices. 

There are several accessible vulnerability scanners available. Consider using NMAP or other free scanning tools if creating a vulnerability scanner is not a possibility. The most basic NMAP parameters can be used to identify a wide variety of device kinds and vulnerabilities.

Run an Intrusion Detection System (IDS) or Intrusion Prevention System (IPS) on the network. 

Even though running an IDS or IPS continuously on your network won't catch all malicious network traffic, if an IoT device gets past the IDS/IPS, it can give you a good indication that it has been infiltrated. Businesses can choose one of numerous commercial and non-commercial versions offered. Additionally, once an IDS is in place, we advise firms to regularly update their signatures in order to detect known attack patterns.

IDS/IPS systems are often able to detect communications to known threat locations. It is a clear sign that a system is infiltrated if it detects internal systems communicating outbound to a known threat site. Obfuscating the attack is possible, but having a robust IDS/IPS in place is an excellent method to catch and potentially stop many attacks as they are happening.

Ensure proper management of all IoT devices. 

Patch management at the local device level and enterprise-wide inventory management are both components of proper device management. Inventory control will guarantee that remotely managed devices are categorised and that records specifying device registration, configuration, authentication, and other relevant information are in place. 

Once your business is aware of the location of IoT devices on the network, give each type of device a manager and assign one person to handle routine device upgrades. If a gadget needs internet access, we advise allowing it only seldom or limiting access to the update location. With the right firewall management techniques, this is possible.

Restrict internal and external port communication on your firewalls. 

We also advise businesses to forgo outbound communication until it is absolutely necessary in order to increase IoT security. Common services that are accessible from the business network include ports 80 and 443, which are often related to the internet. However, other VLANs connected to specific device types might not need 80/443. Due to the fact that they permit web browsing, are hardly monitored, and provide a gateway into the network, these two ports are well known to represent serious network dangers. Given that they are frequently left open in most organisations, malevolent hackers and identity thieves frequently use such ports to exfiltrate data. This can open a backdoor to the company.

Remove unsupported operating systems, applications, and devices from the network. 

Conduct an inventory that identifies the operating system that a device may be using to enhance IoT security. Microsoft no longer updates Windows XP or Windows 7, and other Linux distributions are probably also unsupported. That operating system shouldn't be linked to the network if you can no longer patch it. It should also not be linked to the network if the vendor has gone out of business or no longer offers updates for the device.

Conclusion

Businesses may secure common entry points into their network by putting in place a few basic IoT security measures. A cyber security consulting company can then assist when it's time for a more sophisticated approach or to outsource the IoT security role. A variety of tools and services are available from Cyber Security Services to assist in identifying IoT hazards in your business.

https://prilient.com/blog/iot-unplugged--bridging-the-physical-and-the-digital-world

Read more
Comments