IoT has progressively made its way into the day-to-day lives of both individuals and businesses. From cars to coffee makers to smart factories, the devices that surround us are becoming increasingly connected. The benefits of bringing IoT into our homes and offices are numerous. We have increased efficiency, improved communication, and greater productivity, to cite but a few — but it comes with its fair share of risks. Here is how IoT can put your data at risk.

A recent report revealed that over 90% of data transactions on IoT devices are unencrypted. Furthermore, there is increasing concern about the role IoT could play in giving corporations excessive access to individuals’ personal data. Identifiable information and data is all the more concerning when you take into account the fact that the number of IoT devices is set to exceed 50 billion within the next two years.

With this in mind, what are the main threats IoT poses to you and your customers’ data, and what are the steps you can take to protect it?

Why IoT Devices Can Pose a Security Problem

One term we hear a lot when talking about cybersecurity is “attack surface” – the number of potential ways an attacker can gain access to a device or network in order to harvest data or disrupt performance. A key risk with IoT is the sheer number of endpoints, meaning the number of devices connected to the Internet that can offer attackers a point of entry and expose your network to risk.

To avoid the security threats there’s a need to fully understand the potential security threats posed by IoT.

This aspect is a particular threat to business, as while the chance of a single device being breached is relatively small, that risk increases exponentially when a network comprises a large number of them. Two years ago, hackers gained access to a casino database in a way that wouldn’t seem out of place in a James Bond movie: through the businesses’ high-tech fish tank, enabling them to exfiltrate 10 gigabytes of data.

The smart devices that are often found in personal homes are also vulnerable to hacking and excessive data gathering. Connected appliances, surveillance cameras and smart toys all offer potential entry points to hackers, while smart TVs were recently found to be leaking data, such as locations and IP addresses, to corporations such as Google, Facebook, and Netflix even when the owner didn’t actually have a Netflix account. All the more worryingly, data was being shared even when the devices were idle.

The Biggest IoT Threats

The risks that businesses and individuals expose themselves to by neglecting to properly secure their networks include:

Sensitive data leaks

The data processed by IoT devices is potentially extremely sensitive. With office and home security systems increasingly mediated by IoT (doorbells and surveillance cameras being just a couple of examples), criminal attacks can pose a serious problem.

The huge volume of data habitually collected by IoT devices was exposed this year when a database owned by the Chinese firm Orvibo, who offer a smart home appliance platform, was found to have no password protection despite containing logs relating to 2 million worldwide users, including individuals and hotel chains. The data included insufficiently-protected user passwords, reset codes, precise locations, and even a recorded conversation.

DDoS attacks

Botnets are another way for cybercriminals to wreak havoc using IoT devices. Botnets consist of, as their name suggests, networks of bots running on Internet-connected devices. They are primarily known for their role in DDoS (Distributed Denial of Service) attacks, in which a stream of network requests is sent to a network that a malicious entity wishes to bring down.

Examples include the infamous 2016 DDoS attack on the DNS provider Dyn, which effectively took down major sites such as Twitter, Tumblr, Netflix, Amazon, and Spotify among others. More recently, a major entertainment industry player was the victim of a large-scale DDoS attack associated with over 400,000 IoT devices.

Hacking and sabotage

Hacking an IoT device potentially enables cybercriminals to pilot it. This can lead to more or less critical situations according to the type of device (while hacking your robo-vac could potentially provide access to sensitive information, attackers are unlikely to remotely clean your apartment for you – and if they do, it doesn’t really matter).

It’s a different story, however, when hackers gain control of manufacturing systems or autonomous vehicles.

Who is the Most Vulnerable?

It’s important to be aware that any business or household that doesn’t take the right steps to protect their data is exposed to a potential attack. As mentioned above, manufacturing is a particularly vulnerable sector. More and more factories are using IoT not only to boost productivity but also to power core operations, meaning that a single attack has the potential to bring production to a complete halt.

In December 2015, the first known cyberattack on a power grid took place in Ukraine. Clear back in 2015. These events are warnings that individuals and businesses can and should take note of, and protect their systems. Criminals managed to compromise the IT systems of three energy providers and successfully disrupt the electricity supply to users.

A few years earlier, an Iranian uranium enrichment plant was compromised by the Stuxnet virus and its centrifuges permanently damaged. This attack was notable at the time in that its aim was not just to disrupt computer systems or steal information — but the criminals also wanted to inflict physical damage on equipment.

Companies that handle and record sensitive customer information need to be particularly wary of the threat posed by IoT breaches. Even small businesses tend to own a certain number of potential endpoint threats, such as cameras, printers, webcams, and microphones, that offer entry points to cybercriminals.

And it’s not just businesses that are potentially at risk. HBO’s Silicon Valley played the idea of a hackable smart fridge for laughs, but insecure home IoT devices pose a very real security threat. A recent Avast/Stanford University study revealed that 66% of North American households now possess at least one IoT device and that a significant number of those devices use obsolete protocols such as Telnet or FTP.

Maintaining IoT Security

So with all this in mind, what can be done to secure endpoints and guarantee the safety of your devices – and network in general?

First things first: manufacturers need to step up their game.

As enthusiasm for IoT devices grows, so does the speed with which companies put them out there.

Efforts need to be made to ensure that consumer IoT appliances are secure out of the box.

Any required updates should be easy to implement by the average user.

Clear but detailed privacy policies are necessary to inform users about exactly what data manufacturers have access to.

Easy to understand protocols, enabling users to make informed decisions about what they share and with who.

Steps that individuals and businesses can take to ensure their security include:

Network security

A compromised router will leave your entire network open to attack. Routers need to be protected by a strong password, regular updates, and a firewall.

Passwords

Is the mention of passwords coming as a surprise to anyone?

Please — change your passwords. Please. Passwords should not even have to be mentioned It should go without saying that weak passwords — or those wily default passwords the appliance came with? Change them — they make your device vulnerable to attacks.

Patches

IoT devices should be able to receive updates, and therefore patches. The need for patches should come from the manufacturer as they discover a vulnerability. It’s important to ensure that your appliances are up to date at all times.

Monitoring

Monitoring is especially important for businesses running a network of connected devices.

All IoT should be identified and inventoried, and network traffic to and from the devices analyzed in order to quickly spot anomalous behavior. The due diligence of monitoring is a huge task and likely not going to garner a lot of support. But you can monitor your own devices, watch for updates — and take care of yourself and your devices.

In a nutshell? While the benefits of IoT more than live up to the hype — but it’s important to keep its potential risks in mind and take steps to ensure that it doesn’t make your home or business vulnerable to attack.

Source: Readwrite.com

Powered by NewsAPI.org