The Internet of Things (IoT) as a phrase has been bubbling under for a number of years, but 2017 has really seen a meteoric rise in the sheer number of smart meters, smart bulbs, and other devices that can collect data about their environment and react to it. From cars to clothing, they are increasingly being adopted in our day-to-day lives, but unfortunately, this means that there is also more focus on their security aspect.
More specifically, the IoT presents new security issues for businesses, especially those that provide numerous devices for their staff to use.
Hackers are working harder at gaining access to companies and their confidential data, and with the rise in Distributed Denial of Service (DDoS) attacks and ransomware, care needs to be taken so that these devices are not a weak entry point. Devices with such capability have many vulnerabilities, and are open to both physical and internal software attack. Every company that is developing IoT systems must take security challenges seriously, and develop protection alongside the more obvious capabilities of the device.
There are two main issues that could result in too little security, these are confidential data being compromised, and DDoS or ransomware attacks. Both of these can come about from a variety of reasons.
Vulnerable Data
To be able to extract data or confidential information, hackers need to be able to gain control over a device somehow. There are various ways of doing this, mostly by either cloning information sent from or to a device in order to pretend to be a legitimate user, or impersonating a valid user.
The worry with the IoT is that it provides more potential vulnerability points due to the increase in number of devices. In the past, the main worry a company would have would be the terminal or laptop that a member of staff used to do their job and the overall network that they connected to. Now, however, we have to worry about laptops, tablets, mobile phones and all sorts of peripheral devices that connect to a network — giving hackers more points of entry.
As well as the increased number of devices to consider, hackers are becoming smarter when it comes to attacks. Realising that a direct security breach is likely to alert staff, new types of attack are emerging which aim to operate more covertly.
An assault known as the man-in-the-middle (MitM) attack is one such covert attack. A man-in-the-middle attack intercepts messages between two legitimate parties. Because all the checks have been carried out and it seems valid, the two parties assume they are conversing with each other. However, the attacker can see both sides of the communication and can alter or extract data at this point. These can all rely on breaking the encryptions relating to the sending and receiving of messages, and all it takes is to find weaknesses in the cryptographic algorithm.
Once they have control over the devices, then data can be extracted or manipulated, leading to either loss of critical or confidential information, or malicious code taking over the host system.
Hacking Attacks
Software is a common way for hackers to gain entry to systems illegally in order to cause havoc. Phishing attacks and the introduction of malware can bring a company to its knees in minutes. For example, a DDoS attack attempts to flood the system with so many requests, that the legitimate ones are prevented from accessing it, and it is important to be alert to possible attacks so they can be dealt with as soon as possible. But once malicious software is in a system, it can be used to steal data, alter information, or damage the IoT devices themselves.
For software to get access to any system that runs or is run by IoT devices, there has to be a security breach. The most common of these is the ability to access devices that are either unsecured, or that still have the original passwords they were sent out with. These could be home routers, cameras, or any IoT device that is password-protected. All of these can then be directed back at a company, flooding their data-centres with illegitimate requests and hampering the normal day-to-day business, or accessing data that otherwise should be secure.
Another problem is outdated firmware. If hackers have discovered a vulnerability in the firmware, they can exploit that if the device has not been updated with patches frequently enough.
What’s The Solution?
Staying secure when it comes to IoT devices is much the same as maintaining a secure network, it’s about remaining vigilant and implementing preventative measures to keep devices safe. Prevention is always better than cure when it comes to commercial security.
Ensuring that devices are updated regularly in terms of their operating system, firmware and the apps that they use will cut out a lot of potential attacks. We’d also say that if your devices/network is business critical, getting a thorough security audit carried out would be very wise. We offer this service, call us on 03300 53 59 55 to arrange an audit.
We’d also recommend having a regular IT Support contract in place with a company that knows what they’re doing when it comes to security is worthwhile as it gives you constant protection. Again, this is a service we offer, feel free to call us on 03300 53 59 55 to discuss your options.
Conclusion
It seems clear that for businesses to be safe from incursion, they need to be constantly on the alert for any unusual behaviour on their systems, and to ensure that there is no weak link within their products. Packaging devices with firmware that is current, and that can be updated as and when required, is essential. And users must be alerted to the importance of changing the default password when acquiring a new product.
As described in this ZDnet report, the effects of attacks can be far-reaching, and all vulnerability must be protected against as far as possible.
