Written by:
Purandar Das Internet of things (IoT) device use exploded to 10 Billion active devices ranging from wearables to appliances, and even automotive. It’s not just individual users that contribute to that number, there is wide adoption of these devices by business organizations. An estimated 94% of businesses adopted IoT device use in their organization before the end of 2021. These devices serve vital functionality in operations and monitoring. Alarmingly, these devices have a reputation for being less secure than traditionally managed endpoints, 57% of IoT devices are vulnerable to high or medium severity attacks.
Despite the risk, businesses still need IoT devices integrated into their networks. Managing this weakness while reaping the benefits of the IoT functionality is challenging at best. The first step to overcoming IoT vulnerability challenges is for companies to shift how they protect their enterprise assets. Moving from a perimeter-based approach to a data-centric approach makes all the difference. Rather than putting up stronger walls and hoping they won’t fall, shift the focus to protecting the valuable asset that cybercriminals are actually seeking – the data. Data monetization plays a key role as financially motivated attacks continue to be the most common according to Verizon’s Data Breach Incident Report.
This article explores the existing IoT security challenges and how businesses balance the benefits of IoT devices with their inherent risks.
IoT vs Data Security
IoT is ubiquitous in business environments. Its presence in the last few years has only become more prevalent. These devices integrate data and functionality into business processes ranging from badge checking and monitoring to automatically lighting rooms or controlling HVAC settings. This automation saves businesses money and reduces the cost of day-to-day operations, with 83% of organizations showing improved efficiency through IoT devices.
However, these advantages are tempered by the risks associated with IoT devices. Unmitigated vulnerabilities and account management challenges make these devices difficult to operate safely, creating organizational risk. IoT can be a valuable component of the IT ecosystem for organizations that approach this with their eyes wide open and with a plan to mitigate the risk.
Unmitigated Vulnerabilities
IoT devices are not always vulnerable when they go into production, but a lack of timely updates can transform these devices into ticking time bombs on your network. By their design, many IoT devices lack automated updating capabilities that are standard in smartphones and PCs. Even if the manufacturer has developed updates for the device, they still have to be installed by the organization.
Of course, this assumes that the manufacturer is actively supporting the device long-term. Devices supported post-manufacturing may only have patches released on an annual basis, leaving them open to attack for long periods after vulnerabilities are discovered. The vulnerabilities will persist for those that are not supported until the device is replaced with a newer device.
Management Challenges
The other challenge with IoT devices is that they are often utilized as independent devices with unique configuration and management interfaces. Rather than integrating into an existing active directory (AD) or other similar user management infrastructure, IT staff have to log in directly to the device to manage users and permissions for these devices. These tasks may be preempted for more pressing duties in busier organizations, leaving access open for individuals who have changed roles or left the business.
A lack of centralized management also creates visibility gaps. These devices cannot always export logs and alerts to other systems for monitoring. Administrators may miss essential warnings without logging into the devices regularly, which is a time-consuming management task. This visibility gap creates openings where a device can be compromised, and nobody in the organization is aware of it.
Reducing Exposure
Organizations do not need to eliminate all of the IoT on their networks to mitigate the vulnerabilities they bring with them. This approach would damage business productivity and ignore any of the benefits of IoT. Instead, taking a data-centric approach to security and looking for possible threats that may stem from these devices, businesses can safely enjoy all of the benefits that come with IoT while having the capability to defend themselves from the risks.
Purposeful Controls
Taking a data-centric approach to security requires the implementation of controls designed to protect the data. Even if attackers get into the infrastructure, data-centric controls are designed to prevent unauthorized access and keep data confidential, limiting the impact of anyone with stolen credentials or malicious insiders attempting to steal data.
Data-centric controls work in tandem to protect the data no matter where it lies in the IT ecosystem. Access management controls to limit who can access or alter the data. This pairs with data encryption that keeps the data in an unreadable state so that only authorized users with the encryption key can view the data. All of this is topped off with threat detection to identify when a misuse or inappropriate attempt to access the data occurs.
Watching For Threats
Constantly monitoring for threats is crucial for any modern enterprise. This is even more important for organizations with risky infrastructure assets such as IoT. Rather than waiting for an actual compromise to occur, it is prudent for businesses to consider that there are already compromised assets.
Continuous monitoring gives organizations the visibility they need to protect their data. Effective monitoring needs to go beyond simply collecting the data into a centralized interface and instead incorporate active threat detection. This type of detection leverages artificial intelligence (AI) and machine learning (ML) to determine normal baselines of behavior so that abnormal and high-risk behaviors can be rapidly detected and remediated. With active threat detection, attacks can be seen and stopped before attackers can gain a foothold, dramatically reducing the impact of an attack.
Going Beyond the Basics
Organizations need to reap the benefits of IoT devices without having to compromise the security of their data. By taking a data-centric approach to security, the organization emphasizes security where it belongs – at the data. With this approach, organizations defend against risky infrastructure, insider threats, and compromised credentials. Doing this right requires a holistic solution to protect the data on all fronts.
Sotero is a leader in providing data security solutions for organizations. Its platform takes a holistic approach to data protection, applying multiple layers of controls. Going beyond basic encryption, Sotero weaves in access controls to streamline data management. Sotero’s behavioral monitoring keeps track of your resources and delivers visibility of misuse through a single pane of glass interface, catching attacks early.
Contact a data security expert to learn more.