Recently, I attended an IT Technologies conference in Washington DC in my role as a member of the national
CompTIA IT Security Advisory Council. The conference was dedicated to identifying growing technologies
and trends in IT for professional in that industry and businesses heavily invested in technology.
Two of the hot topics discussed were the growth of Artificial Intelligence and
IoT (the Internet Of Things). For those of you who don’t follow computer
technology and trends closely, the Internet Of Things is already ubiquitous in
businesses like yours whether you realize it or not.
According to Gartner Research, a top industry research firm, there are over
8 billion “things” already connected to the Internet today, and that number
will grow to over 21 billion by the end of 2020.
While it’s fun to joke about having “smart” toasters that connect to the Internet
so your smart phone can tell you when your toast is ready, it can’t be denied
that there are valuable connected devices that already are active and running
in the majority of businesses today and the threats created by the poor security
in many of these devices are creating real security threats for businesses like yours.
Does your HVAC vendor monitor and manage your office climate and lighting environment? How about a web enabled video surveillance system
for your office or externally managed Wi-Fi devices like those from Meraki and others? Do your printers report when they need paper or toner to
Xerox or Minolta? Have you got a managed VOIP system? Security Sensors that guard your property? How about Alexa, Amazon Echo or
Google Home at your house? Ring doorbell cameras? The list of Internet connected devices goes on and on but the overriding questions
that apply to all of them is “How secure are these devices?” and “How do you protect yourself from security flaws that may exist in them?”
We all know what happened to Target a few years ago when their climate control provider lost track of a password for a control device.
The hackers laterally crossed the network in one of their stores and got into their POS system and millions of credit card records were stolen.
You think we’re exaggerating the seriousness of these threats? The 2016 Mirai Internet botnet attack, which was orchestrated as a
distributed denial of service attack through 300,000 vulnerable Internet of Things devices like webcams, routers and video recorders,
showed just how big of an impact the weakness off IoT device security can be. It took down a good part of the Internet on the East Coast
of the U.S. using insecure IoT devices. The latest bot-herding software, Wicked, is a more sophisticated Mirai relative.
It includes at least three new exploits targeting known vulnerabilities in various IoT devices, including security cameras and Netgear routers.
The average time to discovery of a malware breach
from the time of infection is over 85 days.
Imagine the damage that can be done to your network and business in 85 days!
You might think that it doesn’t matter if a phone system or an HVAC system is infected because it’s
not your server or PC but statistics show that lateral malware infections of key network devices grow
dramatically once the perimeter firewall has been compromised. Once inside your network, malware
can explore and infect other devices like servers and PC’s. It just takes time.
The more IoT devices you have connected to your backbone infrastructure (your Wi-Fi or cabling connections)
the more attention you have to pay to your network security defenses AND your internal
detection systems to watch for lateral movement of malware.
