Internet of Broken Things? Ten key facts about the IoT

1) IoT - a cybercriminal’s dream
Any device or sensor with an IP address connected to a corporate network is an entry point for hackers and other cybercriminals - like leaving your front door wide open for thieves.

Managing endpoints is already a challenge, but the IoT will usher in a raft of new network-connected devices that threaten to overwhelm the IT department charged with securing them - a thankless task considering the lack of basic safeguards in place on the devices.

Of particular concern is that many IoT devices are not designed to be secured or updated after deployment. Any vulnerabilities discovered post deployment cannot be protected against in the device; and corrupted devices cannot be cleansed.

2) IT or OT
IT professionals are more used to securing PCs, laptops and other devices, but they will now be expected to become experts in areas such as smart lighting, heating and air conditioning systems, security cameras and integrated facilities management systems.

A lack of experience in this Operating Technology (OT) is a cause for concern. It is seen as operational rather than strategic, so deployment and management is often shifted well away from Board awareness and oversight.

Nevertheless, the majority of organisations are deploying IoT technology with minimal regard to the risk profile or the tactical requirements needed to secure them against unforeseen consequences.

3) Increase in DDoS attacks
DDoS (Distributed Denial of Service) attacks are on the rise, with 41 percent of UK organisations saying they have experienced one.

IoT devices are a perfect vehicle for criminals to access a company’s network. 2016’s high profile Mirai attack used IoT devices to mount wide-scale DDoS attacks that disrupted internet service for more than 900,000 Deutsche Telekom customers in Germany, and infected almost 2,400 TalkTalk routers in the UK.

4) And ransomware attacks
There has been an almost 2,000% jump in ransomware detections since 2015. In 2017, WannaCry targeted more than 200,000 computers across 150 countries, with damages ranging from hundreds to billions of dollars.

While most ransomware attacks currently infiltrate an organisation via email, IoT presents a new delivery system for both mass and targeted attacks.

5) Increasing intensity and sophistication of attacks
The sophistication of attacks targeting organisations is accelerating at an unprecedented rate, with criminals leveraging the disruptive opportunities the IoT brings.

According to Fortinet’s latest Quarterly Threat Landscape report, three of the top twenty attacks identified in Q4 2017 were IoT botnets. But unlike previous attacks, which focused on a single vulnerability, new IoT botnets such as Reaper and Hajime target multiple vulnerabilities simultaneously, which is much harder to combat.

WiFi cameras were targeted by criminals, with more than four times the number of exploit attempts detected over Q3 2017.

6) The effects of an attack
The aftermath of a cyberattack can be devastating for any company, leading to huge financial losses, compounded by regulatory fines for data breaches, and plummeting market share or job losses. At best, a company could suffer irreparable reputational damage and loss of customer loyalty.

On top of that, IoT devices have the potential to create organisational and infrastructure risks, and even pose a threat to human life, if attacked. We have already seen the impact of nation-state attack tools being used as nation state weapons, then getting out and being used in commercial criminal activity.

7) Profit over security
It’s crazy to think that devices with the potential to enable so much damage to homes, businesses and even entire cities often lack basic security design, implementation and testing. In the main this is because device manufacturers are pushing through their products to get them to market as quickly as possible, to cash in on the current buzz around IoT.

Lawrence Munro, Vice President SpiderLabs at Trustwave agreed IoT manufacturers are sidestepping security fundamentals: “We are seeing lack of familiarity with secure coding concepts resulting in vulnerabilities, some of them a decade old, incorporated into final designs,” he noted.

8) Can you see the problem?
Another huge problem is that once a network in attacked, it’s much easier for subsequent attacks to occur.

Yet, recent data has shown just half of IT decision makers feel confident they have full visibility and control of all devices with network access. The same percentage believe they have full visibility of the access level of all third parties, who frequently have access to networks; and only 54% say they have full visibility and control of all employees.

9) Turning a blind eye
Despite security concerns often cited as the number one barrier to greater IoT adoption, Trustwave research has shown 61% of firms who have deployed some level of IoT technology have had to deal with a security incident related to IoT, and 55% believe an attack will occur sometime during the next two years. Only 28% of organisations surveyed consider that their IoT security strategy is ‘very important’ when compared to other cybersecurity priorities.

10) Efforts to standardise
In the UK, the government’s five year National Cyber Security Programme (NCSP) is looking to work with the IT industry to build security into IoT devices through its ‘Secure by Default’ initiative. The group published a review earlier this month that proposes a draft Code of Practice for IoT manufacturers and developers.

While there seems to be some light at the end of the tunnel, it may not be enough. Regulators won’t force device manufacturers to introduce the necessary security regulations and practices before thousands of businesses fall victim to attacks. Turning a blind eye to the IoT security risks could leave your organisation permanently paralysed.