By Chakradhar Kommera, CEO & Co Founder, Ensurity Technologies India
IoT networks have seen significant proliferation over the recent years. Increased industrial automation, connected mobility (connected cars) and growing need for performance improvement through real time analytics are the key drivers of IoT. India ranked third in the list of countries where the highest number of cyber threats were detected, and second in terms of targeted attacks in 2017, according to security software firm Symantec.
In India privacy and personal data protection is the focus for 2018 and beyond. Growing number of organizations are now processing Aadhaar-related information and personally identifiable information of customers, giving rise to the concerns around the privacy and personal data protection.
India is witnessing a fast paced change in its cybersecurity trends and trying to keep up with the challenges. However, IoT networks pose significant security risks to enterprises. The risk levels vary across sectors, with utilities, industrial plants, automobiles and transportation being exposed the most. It is prudent for enterprises to first identify the risks in time to become IoT ready.
Types of IoT threats to enterprises
Bot attacks: We have seen significant increase in bot and DDoS (distributed denial of service) attacks on enterprises and utilities from IoT devices. Since most IoT devices are unsophisticated end points with weak identity management, bot attacks are easy to spread throughout the internet. Unlike regular computers and mobile devices, IoT devices don’t have much virus or malware protection, so it is easy to spread malware through IoT devices. A DDoS attack caused by Mirai botnet, brought when whole internet in the US East coast down on Oct 12, 2016.
Malware penetration: IoT devices like DVRs and cameras can be used to penetrate malware into enterprise systems.
Connected car risks: With connected and driver less cars becoming popular, risks of cars being hacked and hijacked remotely are increasing.
Industrial sabotage: Attempts to damage utility systems on a mass scale have been increasing recently. The near successful attempt to cause damage to Aramco plants a few years ago is a case in point. Nations need to protect their utility networks from being brought down.
Challenges in identifying IoT threats
There are broadly two kinds of risks that organizations need to embrace with the rise in IoT devices.
1) Risks coming from IoT devices directly under the organization’s control connected through a common network and
2) Risks emanating from devices not directly under the organization’s purview or supervision which means private networks. It is a significant challenge for organizations even to map out the total connectivity, prior to even assessing the risks. As organizations rush to increase efficiency and revenues by increasing connectivity rapidly, risks mount significantly.
Today, organizations are installing third party IoT devices like DVRs, cameras, sensors and smart automation systems. It is often these third party devices that pose risk to organizations. How do organizations assess whether these third party devices are secure enough? Smart city planners are in race to automate at a rapid rate, but are they assessing the risks properly before installing?
Most IoT devices are not smart enough to incorporate highly secure protections. For example, most IoT devices maynot be able to run block chain kind of applications. These devices can pose significant riskthird party associated risks. Like in traditional internet architecture, third party devices are the easiest way for attackers to penetrate into organizations. For example, if a defence establishment purchases third party peripheral security cameras and connects to internal systems, the organization needs to have a proper ring fencing its core systems from these third party devices. It is also important to note the third party devices themselves are interconnected, further increasing the risk surface.
Solutions to the rescue
Calibrated deployment of IoT connectivity and rapid deployment of IoT connections without careful security assessment would increase risks isolated code execution solutions on IoT devices. There is a need to run isolated code execution solutions on IoT devices to cut risk of them being compromised. Since connectivity through IoT devices is so rapid in number, identity management requires automated, scalable solutions. A lot of interaction that happen through human interaction needs to be secured.
Solutions like secure firmware USB loaders, biometric authentication solutions will help enterprises to keep a check on these human touchpoints. Secure identity management and firmware update solutions cut down the risk of malware penetrating into IoT networks in the first place. This could cut down IoT malware risk significantly.
It is advisable to adopt an intermediate Fog layer which would reduce the risks. This would especially help reduce BOT and DDoS attacks. OpenFog consortium (www.openfogconsoritum.org) is working to develop standards that would help IoT networks.
Reiterating the statement made above 2018 is going to be a momentous year for cybersecurity. A lot will be on the stake as the nature and frequency of cyber attacks will force organizations to multiply their focus it. It is high time that CIOs and CISOs keep their stakes high to deal with any security challenge that might cross their way.
