How to Secure Your Internet of Things
You didn't have to attend this month's Black Hat and DefCon shows in Las Vegas to draw one big conclusion: Researchers are having a field day with hacking internet-connected devices. Conference-goers were treated to presentations detailing how to compromise cars, rifles, skateboards and safes, just to name a few.
Now the big question is: Have we reached a tipping point that will awaken both developers and adopters to the security risks posed by these products?
Of course, the concept of taking advantage of vulnerabilities in the Internet of Things (IoT) - the network of physical objects that are embedded with technology enabling data exchange via the internet - is nothing new.
But many people still view IoT as novelty, even though it is morphing into normality. If you can look past the so-called smart home of IP-enabled toasters and sprinklers, the Internet of Things is rapidly expanding into the business world, where use cases for IoT abound - from traffic monitoring systems in cities to sensors that target shoppers with special offers in stores to implantable medical devices for patients in hospitals to industrial automation systems in power plants.
Studies are shedding light on the astonishing rate at which IoT is growing: Surveys estimate that by the end of this decade, some 25 billion connected objects will be in use. These devices will generate a projected 44 trillion gigabytes of data by that same year.
Those types of numbers will incite adversaries. And based on the success that researchers already have demonstrated, it appears history is repeating itself in terms of the security and vulnerability of these technologies. As we learned with the rise of the internet and the ensuing mobile age, security often gets overlooked in the development, implementation and maintenance stages - and here's yet another trend that will further widen the risk profile for a company.
That simply can't happen considering there are soon to be tens of billions of IoT products, which may be enticing in their own right but also provide plush entryways to the larger corporate network where a host of problems can occur, including denial-of-service attacks, privacy violations, malware infections, system hijackings, sensitive data theft and even bodily harm.
By no means an exhaustive list, here are five things you should be doing to secure your Internet of Things and reduce your risk, either as a developer or an implementer:
Know what you've signed up for
If you're creating or deploying an IoT technology, understand how it operates. What data is it collecting? Why is it being collected? Where is it stored?
Avoid the market rush
Security should never be an afterthought. A breach will undoubtedly prove more costly in terms of notification, recalls, lawsuits and remediation than you would have spent if security was built in and maintained from the start.
Test, don't guess
Security testing helps you understand what assets reside on your network and discover weaknesses across your IoT environment - in embedded devices, interface applications, back-end services, APIs, cloud clusters and the connections in between.
Hold vendors accountable
If you're purchasing IoT from a third-party, vet their security in much the same way you would your own. Aside from obtaining a service-level agreement that addresses end-to-end requirements, ask them directly: "What do you do to ensure the security of your IoT product/service and are you able to demonstrate that?
Practice defense in-depth
IoT is not just the endpoint, but an entire ecosystem that requires a thorough set of security measures, including authentication controls, DDoS protection, intrusion prevention, web application firewalls, incident monitoring, patching and incident response.
A recent Trustwave webinar comprehensively covered the IoT revolution and what it means for the security of businesses. You can watch it here on demand.
