What is IoT security?

Until relatively recently, business and personal networks operated with few potential access points. But IoT devices changed all of that. Every new thing—from the fitness tracker worn on a user’s wrist to the IP cameras stationed around an office—becomes a vulnerability. Often, these smart objects lack the more robust protection afforded to traditional devices, making them obvious targets. And when hackers breach IoT defences, they not only gain access to sensitive user data but may also move laterally into the rest of the network.

In other words, unsecured IoT can act as an unguarded backdoor to your systems and databases. And just like IoT itself, the number and types of threats are growing.

IoT creates an exponentially expanding attack surface that can be extremely difficult to defend. But what makes IoT even more dangerous is that many of the devices themselves operate under obsolete security standards. Without the benefit of modern IT-based malware prevention, IoT devices may fall prey to outdated attacks that would otherwise pose no threat to the network. At the same time, cybercriminals are creating sophisticated new tactics designed specifically to overcome IoT defences.

Examples of major IoT security threats include:

• IoT worms
  Probably the most common IoT threat are IoT worms. These kinds of malicious software self-replicate and self-propagate, spreading throughout networks to take control of uninfected systems.
• IoT botnets
  Often used to launch distributed denial-of-service (DDoS) attacks, botnets are collections of compromised IoT devices (such as routers) that have been infected with malware.
• IoT ransomware
  IoT ransomware allows cybercriminals to take control of IoT devices to lock out authorised users. The hacker then demands payment in exchange for unlocking the device.
• Man-in-the-middle attacks
  Unencrypted IoT devices may fall victim to man-in-the-middle (MitM) attacks, where a hacker will position themselves between the device and the network, eavesdropping on communications.
• Firmware hijacking
  Cybercriminals may hijack an IoT device by sending users fake firmware update notifications linking to malicious websites.

Although there are many different methodologies that each play a part in IoT security, there are also issues that make securing IoT devices a difficult prospect. Here, we highlight some of the challenges that may prevent an organisation from achieving a complete IoT security posture:

• Lack of visibility/shadow IT
  As IoT devices become more ubiquitous, they are also becoming harder to account for. Users will often deploy their own IoT devices on company networks without the knowledge of the IT department, making it impossible to effectively monitor these new network access points.
• Massive attack surface
  With every new wearable fitness tracker, digital assistant or smart light bulb brought into an organisation, the number of potentially exploitable vulnerabilities increases. Larger attack surfaces require more cost and energy to secure.
• Difficult integration
  Most businesses rely on a variety of security tools. As new IoT devices are introduced, integrating these third-party devices with existing solutions may be problematic.
  
• Open-source software
  Many IoT devices incorporate open-source software which uses publicly available code. Attackers can easily access information about the code to discover exploitable vulnerabilities.
• Unmanageable data loads
  When it comes to data, it is possible to have too much of a good thing. An ever-increasing number of IoT devices can create an overload of data, making it difficult to manage and secure.
• Weak user credentials
  Many IoT devices are designed for out-of-the-box deployment and include default passwords which users are then encouraged to change. Unfortunately, too often these place-holder passwords do not get updated, providing attackers with direct access.
• Insufficient computer power
  Most IoT devices are small and may not have enough computing power to integrate important security software.