Why it is Time to Get Serious about Securing IoT Network Connectivity
If your organization is serious about cybersecurity and compliance, it is most likely implementing many of the best practice security recommendations we hear about all the time. You are keeping all your operating systems and software patched and up to date while regularly updating the firmware for your network devices. You have strict password policies that are supported by MFA, and you have the latest next generation firewall securing your perimeter. You are doing a great job of securing your traditional IT assets, but there still may be an elephant in the room that is being ignored – your IoT devices.
It is a challenge that everyone is dealing with. We aren’t just talking about IP cameras. Manufacturing and Healthcare are two of the largest verticals that utilize IoT, employing a gamut of devices such as scanning machines, sensory devices, and infusion pumps. The list of devices is endless. Unfortunately, the list of vulnerabilities they introduce to your enterprise is endless too.
IoT is the Weakest Link
It has been a founding principle of military strategists going back to ancient times. Avoid strength and attack weakness. For a typical enterprise, these weak links often appear as IoT devices. There are multiple reasons why they are so vulnerable to cyberattacks.
- Many IoT devices aren’t built with security in mind and have limited security features.
- They often have outdated software or legacy protocols and are not designed to receive updates that can fix these vulnerabilities.
- Many of these devices are internet facing and lack proper the security measures to secure their connection.
- IoT devices are often deployed using their default passwords that are simple to guess or crack.
IoT Devices often cross interorganizational domains, IT teams or even partners. On top of their vulnerable nature there is often not only a lack of mindfulness concerning their exploitable vulnerabilities and a lack of awareness of just how many IoT devices are in place throughout the network. Many times, these devices are deployed by a third-party vendor that is contracted by an internal business unit and never get properly documented and recorded on the company’s asset inventory list.
New Reasons to Get Serious about IoT Security
These unpatched devices with legacy operating systems and improper security features obviously make themselves vulnerable to attack. Some organizations have an inherent false sense of security however when it comes to protecting against that ominous event and IoT security gets pushed back. However, there are other reasons other than the threat of attack as to why company leaders need to get serious about securing these devices.
Anyone who has tried to purchase or renew a cyber insurance policy knows how costly and difficult that process has become recently. As the number of cyberattacks have grown exponentially over the past several years, so to have the number of payouts that insurance companies are obligated to fulfill. As a result, insurance companies have increased rates, added policy exclusions, and capped future payouts. They are also requiring details of your cybersecurity strategy and documented proof regarding implemented security controls and policies. Insurance companies are aware of the vulnerability of IoT. Those companies that have proper inventory visibility of their IoT device fleet and the third-party tools to secure them are eligible for lower insurance rates.
The other is compliancy. The number of governmental regulations such as GDPR, HIPAA, and CCPA is growing not to mention industry compliance standards and IoT is fast becoming a part of it. For instance, the FDA has issued guidance on the cybersecurity of medical devices. Organizations need a way to show documented compliancy to auditors and regulators to avoid costly fines and possible litigation. In addition, some companies are demanding compliancy as a requirement for doing business with them.
A Profile and Posturing Security Strategy
IT has traditionally segmented IoT devices by placing them on a separate VLAN, but creating dozens of VLANs isn’t going to solve all your problems. Segmentation is important but isn’t only one piece of the puzzle. The first step is attaining full visibility into your IoT environment. You can’t protect what you can’t see or don’t know exists. This is why it is imperative to garner an asset inventory of everything that is on your network. This will often involve the use of some type of automated discovery tool because new IoT devices are constantly being added as new systems and technologies are implemented.
Visibility is an integral part of the profiling process. A profiling and posturing approach allows your organization to identify security threats and implement appropriate security measures. You already profile users and devices across your organization. IoT devices must be profiled as well. Profiling involves collecting information to learn about your IoT assets. This information includes things such as vendor identity, software version and serial number. It involves observing behavior patterns to see how a device connects to the network and what it communicates with. All of this allows you to create a meaningful profile that can be used to assess the risk level of that device.
Posturing is the next level. Posturing involves implementing security measures based on the risk posture outlined in the established profile. Devices with similar risk postures are grouped together and aligned with a respective strategy to secure them. Policies can be created with third-party tools that restrict IoT to Internet traffic only or confine them to their prescribed actions that were logged in the profiling phase.
Cisco is a Leader in IoT Security
Managing and security IoT is a real challenge due to the scale and velocity in which IoT devices are deployed. Management that relies on human intervention and static dashboards can’t handle the scalable dynamic nature of IoT technology. What is needed is intelligent automation, not just to secure them, but deploy, monitor, and manage them as well.
Cisco has been identified as a leading IoT solutions provider by both Forrester and Frost & Sullivan. Cisco is providing solutions that allow business to fully leverage their IoT environments to improve their business outcomes. Cisco uses a profile and posture approach that gives organizations full visibility into what devices are operating within their network and what type of risks they introduce. By automating routine networking tasks, IoT switch, router, next-generation firewall, and wireless configurations can be delivered quickly to get newly deployed IoT devices operating in secure fashion.
The Role of Evolving Solutions
While some companies have procrastinated the endeavor of securing their IoT environments, Evolving Solutions has embraced the opportunity with our clients. Our solutions are designed only after we understand the outcome our clients are looking for, whether that be a single platform or best of breed approach. We give them visibility, which often sheds light into how complex their environments are. We then give them options that can deliver automated remediation and compliance. In summary we meet them where they are and map out a strategy to get them where they need to be. IoT security is one of our strengths, and our experience and knowledge base can make your IoT environments a point of strength as well.
