An Introduction to IoT Network Security

An automated light switch, a temperature control system in an office building or a digital sign found in a school cafeteria, all of these have something in common, they can make a network vulnerable once connected to the Internet. The Internet of Things (IoT) presents a growing attack surface for bad actors who find ever more creative ways to exploit devices, be it ones in living rooms or used for businesses, namely building control systems.

The network is now the focal point for IoT security. The devices connect to the network and the network touches all data and workloads. This is how hackers can move laterally to compromise whatever systems and data are on the network. Through the network, users and devices can be authenticated, policies and rules put in place to control access and behavior and visibility can be increased to detect anomalies

IT professionals and security operations teams must adapt to this new reality if enterprise networks and sensitive data are to remain protected.  The ever-increasing amount of connected IoT devices comes with an almost equal number of challenges:

• In enterprise environments, people connect these devices without always involving someone from IT. They see an open port and connect a device to it. As a result, enterprises often don't know everything that's on their networks.
• There's a wide variety of innate security within them. Some are intended for enterprises while others are consumer-focused, but both types tend to come with much less in terms of security testing than a laptop, an iPad or another device that might be purchased by an IT department.
• They're not well-monitored, such as temperature control systems found in an office conference room. As long as the devices are working with reasonable performance, most enterprises won't notice if something goes wrong, as opposed to a laptop that has antivirus protection and other ways to detect intrusion.
• There's a lack of visibility and security into the devices in what's an increasingly distributed enterprise IT environment. Often the devices are deployed on the interior of the network, and, while some may be talking externally to a public cloud or other Internet-based systems, many only communicate internally to other systems on the network.

Security deployed around the network's perimeter is blind to such communications unless the enterprise is watching the internal network. And many simply aren't. If those devices are compromised, they become a launching pad into other parts of the network. The school district's digital sign is proof-positive here.

The top IoT issue is that you shouldn't rely on physical security to keep things off a network. There are many places in the wired network that are wide open, and there's little network access control. There's more control and authentication on the wireless side, but, even there, devices that are authenticated often get dropped into an internal VLAN and from there are uncontrolled.

Key steps that can be taken to better protect an enterprise network:

1. Determine what the "thing" should be allowed to do on the network. IoT devices are static in nature; they do the same thing repeatedly and talk only to a single protocol or two. Determine what "good" behavior looks like for these devices.
2. Monitor for abnormal behavior. If an enterprise sees a device operating outside of what's normal, something's probably wrong. Fortunately, because you followed step 1, you know what's on the network, so tracking down a misbehaving device should be easy.
3. Outlaw anonymous connections. Enterprises must know every device that's connected, whether a laptop or a sprinkler controller.
4. Use the network to enforce those rules. Many people don't take this last step, but, without enforcement, polices mean little. If the cameras need to talk only to the network DVR, then use the network to allow only that behavior.

Key to the issue of IoT security as we look to the future is the growing need for security and networking folks to talk to one another. Making collaboration happen is easier said than done. In fact, the two groups can be adversarial, as they're seeking different outcomes. Network operators are happy if all the network packets are flowing quickly with high availability and low latency — even if all those packets are carrying malicious traffic. The security group would probably be happiest if nothing flowed through the network at all.

The network plays a critical role in two areas: first, detecting when an attack is taking place, and second, responding to the attack by shutting down the device, limiting it or slowing it down. There's much you can do with the network infrastructure. IT personnel will almost always want to depend on network firewalls for solving security problems, but don't tend to use a firewall for every single switch port. The security capabilities must be built into the network itself.

That'll mean cooperation between network and security groups. Because this is a cultural issue, it will need to start with high-level executives. That doesn't necessarily mean both sides will report into the same structure. However, the security pros will have to determine what needs to be protected and the network folks will have to decide how to make it happen, all the way at the network edge where the devices connect.

Bringing IT and security groups together is a constant challenge, yet a necessary one to overcome. Without it, there will be more data breaches coming from a wider variety of things rather than end-user systems. HVAC controllers, TV screens, parking toll machines and other IoT devices will continue to be exploited by attackers seeking the easiest entry points into critical parts of the network. And, the IoT devices won't be getting better from a security perspective anytime soon because many of the makers of these things aren't focusing on that.

Written by Jon Green, CTO for Security, Aruba Networks, an HPE Company.