As everyday items become “smarter,” our digital footprints expand. From watches and cars to school-room blackboards and baby bassinets, each of these internet-enabled devices serve as data-transferring endpoints in a system known as the Internet of Things.
IoT Security Definition
IoT security is a focus of cybersecurity that safeguards cloud-based, internet-connected hardware known as IoT devices and their respective networks.
And while these pieces of connected hardware enjoy widespread adoption — with the 15 billion IoT devices that exist today expected to double by 2030 — they historically trade off convenience for security, as each added device introduces a new, vulnerable point-of-access that increases the attack surface of their respective networks.
That’s where IoT security comes in — to safeguard these devices and their networks.
What Is an IoT Device?
An IoT device is a network-connected physical object outfitted with sensors, software and computing systems that is capable of transmitting data over the internet. They have at least one transducer — a sensor or an actuator — that collects information from their environment, which is digitally connected via at least one network interface, like bluetooth or Wi-Fi.
IoT systems are active 24/7, operating on a constant feedback loop that autonomously sends, receives and analyzes data.
Voice-activated virtual assistants, smart fridge interfaces, virtual mirrors and doorbell cameras are part of the IoT device family today.
What Is IoT Security?
IoT security refers to a strategy of safeguards that help protect these internet-enabled devices from cyber attacks. It’s a fairly new discipline of cybersecurity, given the relatively recent introduction to these non-standard computing devices.
Potential IoT attacks “could range from unauthorized access and data theft to physical tampering of the devices,” Eric Sugar, president of information technology service provider ProServeIT, told Built In.
The practice of IoT security involves protecting, identifying and monitoring risks, threats and breaches of a multiple-device system. This also includes fixing any compromised connections found in the chain of smart hardware. The interconnected nature of the IoT means that a network, shared between both IoT devices and standard computing devices, is only as strong as its weakest link.
“Once a single device has been compromised,” Sugar added, “a hacker can then move laterally across the network, accessing and compromising other devices and potentially the entire network.”
Why Is IoT Security Important?
As IoT devices grow in influence, so does the potential for unauthorized network access. By design, IoT devices were not built with any sort of security mechanisms in place. And, in most cases, installing security software after the fact is out of the question.
IoT Devices Can Be Access Points for Hackers
While a hacker might not exactly be interested in how warm you like to keep the house, a smart thermostat may serve as a gateway to gain access to sensitive data, like personal data and confidential records, to sell on the dark web.
One report by cybersecurity company Palo Alto Networks, which scanned 1.2 million IoT devices across enterprise and healthcare organizations, found that 98 percent of all IoT-device traffic was unencrypted. Such a high degree of security oversight puts public safety and economic stability at greater risk.
“This emphasis on connectivity and functionality meant that security features often took a backseat, leaving these devices susceptible to cyber threats,” said Josh Eastburn, director of technical marketing at EMQ Technologies, a software provider of open-source IoT data infrastructure. “This exposure to the public internet further amplifies potential risks.”
“This exposure to the public internet further amplifies potential risks.”
While IoT devices are the kings of convenience leading smart home automation, each additional gadget becomes a new access point to its cloud-based network. The urgency of IoT security comes in when we consider how IoT devices are overseeing more of our personal lives, businesses and critical infrastructure, Eastburn added. Consider the fact that the average American household had 22 connected devices, according to Deloitte.
“You cant think about IoT devices in the same way you think about a laptop, even though they aren’t that much different,” said Rafal Los, head of services at cybersecurity firm ExtraHop.
IoT Devices Are Difficult to Manage and Patch
IoT devices don’t have the ability to install management software on top of them, such as patch management or endpoint security, and they’re not very powerful from a processing perspective comparable to standard IT devices.
“The most important thing to know is that IoT devices are all the complexity of a typical computer — with all the headaches — but without most of the ability to directly manage or interface with that computer,” Los said. “So you have to employ compensating controls for all the things you can’t see or manage in traditional ways.”
Are IoT Devices Secure?
No. Unfortunately, IoT devices are not designed with security in mind. They are also always on, allowing 24/7, remote accessibility — and may even come shipped with malware.
How to Secure IoT Devices
Without proper built-in security, a user must take a proactive, intentional approach to security. Here are some tips from the experts:
Profile Every Device
The first step in IoT security is identifying IoT devices that exist within your network. Once unboxed, IoT devices may autonomously link up to a user’s network; however, these devices often fly under the radar of regular endpoint and security scans. Once visibility is acquired, by either manually locating a device’s address or using an IoT-specific monitoring tool, a user may better manage IoT devices network-wide.
Segment Devices
Segmentation is a process that divides a network into separate components at the device level, whether it be for better bandwidth performance or tighter security. Devices can only “talk” to other devices in the same segment, while others are quarantined or fenced off in their own subnet. For example, a user may want to corral all of their IoT devices into one subnet, separate from servers storing private, sensitive data.
This security measure allows all devices to still run on a shared network while isolating compromised devices or segments in the event of a cyberattack.
And if that’s not enough, the FBI recommends investing in a second network entirely.
Implement Zero-Trust Architectures
A zero-trust approach to IoT security operates under the assumption that it’s under threat. All users must be “authenticated, authorized and continuously validated,” denying default access to anyone — even those connected to permissioned networks. Once granted access, users are allowed access only to the data and functionality of applications pertinent to their role.
Limit Network Endpoints
It’s likely that you have more IoT devices than you’re aware of. So before you purchase app-enhanced items, consider their analogue counterparts that won’t collect data or pose any potential threat to network security.
Routinely Monitor and Scan Communication Channels
Keeping a close eye on IoT devices is best practice for IoT security. Luckily, there are a variety of monitoring and management tools to choose from, whether it be Domotz software-as-a-service package or Siemen’s Senseye Predictive Maintenance, a favorite among large-scale manufacturing organizations with large fleets of IoT devices.
Update Software
Software updates fix bugs, apply security patches and streamline a device’s overall functionality. It also means that hackers now have access to published, open-source vulnerabilities of a software’s previous version. If possible, enabling automatic updates for the software or firmware responsible for your IoT security is highly recommended.
Change Default Passwords
IoT devices arrive with well-documented, default credentials that many users don’t think twice about changing. Sometimes, all it takes for a successful breach is a simple web search. Take the time to create strong, custom passwords, using multi-factor authentication when possible, and avoid weak, guessable or hard-coded passwords in the interest of fending off cybercriminals.
IoT Security Challenges
Network Invisibility
As is, IoT devices do not show up on a network unless they’re manually added. This means that more often than not, they can go unaccounted for and left out of security management. Keeping a log of IoT devices and assigning an admin to monitor them, whether it be in the home or a workplace, can help bypass this problem.
Scale and Diversity
There are a seemingly limitless amount of IoT devices in existence today, available on more than 600 platforms, that take on a myriad of forms and functions. Apart from smart-home automation, IoT devices can be found optimizing supply chains, managing inventory in retail stores, collecting reconnaissance for military operations and remotely monitoring a patient in the healthcare field. This type of range makes for futile universal security strategies.
User Awareness
Until recently, it wasn’t widely known that IoT devices could be hacked. IoT security entered the mainstream after the Mirai botnet attack of 2016, Cloudflare reports, when the virus took down major websites during a massive distributed-denial-of-service attack that targeted over 600,000 IoT devices, including routers, air-quality monitors and surveillance cameras.
No Interface, Limited Computational Ability
IoT devices are often built for a singular purpose. Because of this, they often come with a basic computer processing unit, complete with minimal memory storage and a low-power system, with little to no room for security measures nor an interface to implement them once out-of-box.
In order to protect IoT devices, the burden falls on the buyer, who would need to purchase IoT-specific security software on their own dime.
“[Manufacturers of IoT] devices really need to work harder to make their devices manageable, make security a default and provide services to maintain and upkeep these devices,” Los said. “This is really the biggest problem at the moment, in my opinion.”
Frequently Asked Questions
What is IoT security?
IoT (Internet of Things) security is the practice of securing and safeguarding IoT devices and the networks they are connected to. It is one of several fields in cybersecurity.
In practice, IoT security involves identifying threats and resolving any compromised connections within an IoT device system.
Why is IoT security important?
IoT security is important due to the susceptibility of IoT devices and the growing use of IoT hardware.
Many IoT devices remain unencrypted and can act as a gateway for hackers, where one compromised device could grant someone access to its entire connected network.
IoT devices also aren't inherently designed with security mechanisms in place, and often aren't capable of having patch management or endpoint security software installed after they are built.
Are IoT devices secure?
IoT devices aren't always secure by default. However, measures such as device profiling, implementing zero-trust IoT architecture and limiting network endpoints can increase the security of IoT devices.
