Addressing the Growing IoT Risks to the Enterprise
Addressing the Growing IoT Risks to the Enterprise
Many organizations aren’t keeping up with key IoT security requirements, and hackers are increasingly planting backdoors to launch automated IoT botnet attacks.
Risk Rises
6.4 billion IoT devices currently exist, and that figure is projected to rise to 20 billion by 2020. 65% of enterprises are actively deploying IoT technologies.
Risk #1: IP-Connected Security Systems
Many security systems use proprietary RF technology that lacks authentication and encryption. Many also fail to use frequency hopping, which protects against jamming and spoofing.
Risk #2: IP-Connected Infrastructure
HVAC systems typically operate on the same network as internal systems. Thus, hackers can intercept data, escalate privilege and carry out attacks. They can also manipulate controls.
Risk #3: Connected Printers
Without physical access, hackers can compromise printers to siphon their private documents. They also can gain administrative control of the printer.
Risk #4: VoIP Phones
These devices can be subject to remote snooping and, in some cases, the speakerphone can be switched on without the knowledge of the user.
Risk #5: Smart Appliances
Lax certificate checking and other vulnerabilities open the door to a man-in-the-middle attack to intercept communications and modify traffic between a client and server.
Risk #6: Smart Lightbulbs
These devices, which rely on mesh networks, can be sniffed by attackers. They can extract password-protected WiFi credentials and other data.
How an Attack Unfolds
Attackers can use the internet—as well as wireless communication protocols like WiFi, Bluetooth and ZigBee—to spread an infection. Any network within wireless range is susceptible.
Best Practices
Discover and classify all devices at the time they are connected
Control network access based on device type and behavior
Integrate islands of security and leverage existing investments
Final Thoughts
Security teams should consider a comprehensive and agentless approach that delivers real-time visibility into devices, while eliminating the need for constant re-deployment of security controls.
