IoT Devices: An Advantage or Being Taken Advantage of?

The world is becoming more digitalized each day. Tasks that once took hours, or even days, when performed manually, are now completed within seconds thanks to technology. The Internet of Things (IoT) is one of the latest advancements in the world’s digital revolution. With greater efficiency, it is no surprise that, in the average enterprise, more than 30 percent of all network-connected endpoints are IoT devices – with this figure predicted to grow… Yet, as IoT devices become ingrained in our daily lives, cybercriminals have also found value in these nifty tools; in just the first six months of 2021, IoT attacks increased by 100 percent. As the attack surface expands, it’s safe to say that IoT security needs serious attention. But first, why are these devices so commonly targeted?

Dollars In Data

IoT devices collect data. This is how they function. They collect corporate data, personal data, and financial data. You name it! IoT devices gather it. While this might make the device more accurate, the wealth of data collected by IoT devices makes them highly sought after by bad actors. To attackers – most of whom are financially motivated – data means money, and IoT devices are the slot machines. Whether the device collects valuable data itself or simply acts as a gateway to profitable information, IoT devices are an appealing target for greedy cybercriminals.

A Virtual Pandemic

As the cyber domain becomes the new battlefield, IoT devices can be useful in cyber warfare efforts. Be it, state-sponsored adversaries or terrorists, malicious cyber actors can use IoT devices to cause significant damage to the victim. The connectedness of IoT devices makes launching a botnet attack extremely easy, with the consequences potentially being disastrous. Botnets execute ransomware or distributed denial of service (DDoS) attacks, both of which disrupt operations. While this is damaging to any victim, operational disruption to critical infrastructure will be detrimental to national security. And as critical infrastructure continues to adopt IoT, hostile actors are finding great value in these smart devices.

IoT Attack Surface With No Boundaries

Enterprises’ vulnerabilities increase with the use of IoT devices. By incorporating IoT devices, enterprises become more accessible. Today, there are around 10 billion IoT devices in use, all of which provide a point of entry to the network. Further, as the attack surface expands, it becomes more dispersed as IoT devices get used for various day-to-day activities. The widespread use of IoT devices is especially beneficial for hardware-based attacks – which IoT devices are highly susceptible to – due to the need for physical access. For instance, a smart coffee machine in an enterprise lobby is easily accessible and enough to provide a hardware attacker with network access to allow for further attacks to take place.

But the attack surface expands way beyond the traditional working perimeters. In fact, remote work increases the enterprise's vulnerability. Malicious actors can target the corporate network by exploiting the connectedness of smart home devices. Today, the average home has 25 connected devices, ranging from smart TVs and smart refrigerators to smart cameras and smart security systems. Hence, the global shift to remote work only intensified the threat of IoT devices, and the sudden way it happened meant many organizations did not have time to prepare for this new environment.

IoT Security: Why Aren't We Doing More?

COVID did not mark the beginning of IoT security concerns. IoT devices tend to be inadequately secured, often lacking basic protection, such as strong password configuration. Research by Palo Alto Networks shows that more than 80 percent of internet of medical things (IoMT) devices run on operating systems that are no longer supported. The absence of sufficient security is often down to the harmless appearance of IoT devices – I mean, who would think a coffee machine could cause a security breach? Naturally, these unsuspecting devices lack the necessary security features, yet this leaves a gap that malicious actors exploit.

Addressing the Expanding Attack Surface

IoT devices are vulnerable even when they are afforded protection due to visibility issues. Traditional endpoint and network protection software does not work with IoT; these tools cannot accurately identify, monitor, or secure smart devices. And while IoT security solutions are available, they still do not solve all the visibility challenges. Existing security solutions, be it NAC, EPS, IDS, or IoT Network Security, lack Layer 1 visibility. This blind spot allows rogue devices to operate covertly and exploit IoT devices. IoT devices might be smart devices, but their intelligence is getting exploited by bad actors. To avoid this, enterprises must tackle the visibility issues associated with IoT security, starting with Layer 1.