How can we Secure the Internet of Things (IoT)?

Strategies for Preventing Compromised Devices:
An introduction, for security professionals, to IoT protection and the current smart device landscape.

The rapid expansion of the Internet of Things (IoT) has given rise to an increasingly interconnected world, permeating both consumer and enterprise landscapes. The inherent complexity of IoT ecosystems – from smart security systems and kitchen devices to medical sensors and fire alarms – has spawned a plethora of new vulnerabilities and attack vectors, placing the security of these devices at the forefront of cybersecurity concerns.

In this post, we will look at the current IoT security landscape, provide real-world examples of IoT breaches, and discuss strategies to mitigate risks, including visibility into device relations, lateral movement protection, microsegmentation, and Zero Trust.

Device breaches in the real world

To understand the magnitude of IoT security challenges, consider the following notable incidents:

1. Mirai Botnet (2016): Attackers exploited weak security in multiple IoT devices to create a botnet that launched a massive Distributed Denial of Service (DDoS) attack. Major websites and services, including Twitter, Netflix, Amazon, and even Minecraft, were disrupted. It was even used to crash the website of the prominent cybersecurity journalist Brian Krebs.
2. Jude Medical (2014): The FDA confirmed vulnerabilities in cardiac devices manufactured by St. Jude Medical, exposing patients to potential cyberattacks that could manipulate device settings or drain batteries. It was reported that doctors even disabled the wireless functionality of former U.S. Vice President Dick Cheney’s pacemaker to prevent it from being vulnerable to attack.
3. The Casino Fish Tank (2017): Attackers accessed a casino’s high-roller database via a smart fish tank thermometer. This breach exemplifies how a seemingly innocuous IoT device can be leveraged for lateral movement within a network.
4. Ring Doorbell Hacks (2019): Multiple homeowners reported unauthorized access to their Ring security cameras, highlighting the privacy risks associated with IoT devices in the consumer sphere.

Understanding the IoT security challenges

To effectively address IoT security risks, it is crucial first to comprehend the challenges they pose:

1. Heterogeneity: IoT ecosystems consist of diverse devices, often developed by different manufacturers, operating on varying protocols and standards.
2. Limited Resources: Many IoT devices have constrained processing power and memory, complicating the implementation of robust security measures.
3. Scalability: The sheer number of IoT devices necessitates scalable security solutions.
4. Longevity: IoT devices may have extended lifecycles, making them susceptible to evolving threats and outdated security measures. Vehicles built now will still be on the road in eight to 10 years, but will they be safe considering advances in autonomous functionality?

Mitigating IoT security risks

A comprehensive approach to IoT security should encompass the following strategies:

1. Visibility into Device Relations

An in-depth understanding of the relationships between IoT devices and their associated networks is crucial for effective security. To achieve this:

• Implement real-time monitoring and asset discovery tools to maintain an up-to-date inventory of devices and their connections.
• Utilize machine learning and analytics to identify anomalies and potential threats. Establish policies governing device onboarding, ensuring that only authorized devices are connected to the network.

Relevant Link: NIST’s Guidelines for Managing IoT Cybersecurity and Privacy Risks

2. Lateral Movement Protection

Restricting lateral movement within a network can significantly reduce the potential impact of a compromised IoT device. To achieve this:

• Implement network segmentation to isolate IoT devices from critical infrastructure.
• Apply strict access controls and multi-factor authentication (MFA) to limit unauthorized access.
• Regularly patch and update devices to mitigate known vulnerabilities.

Relevant Link: Lateral Movement Protection Best Practices

3. Segmentation

Segmentation provides granular control over network traffic, enabling the enforcement of security policies at the device level. To implement microsegmentation:

• Identify applications, users, data flows, and dependencies within the network.
• Establish security policies based on the identified flows and dependencies, accounting for the unique characteristics of IoT devices.
• Deploy network segmentation tools, to enforce these policies and segment traffic.
• Continuously monitor and refine policies as the IoT environment evolves.
• Discovering and understanding applications, users, and their interactions with core services.
• Microsegmentation is segmentation and Zero trust best practices.

Relevant Link: Microsegmentation Made Easy

4. Zero Trust

Adopting a Zero Trust security model requires the verification of all applications, users and devices attempting to access resources, regardless of their location. To implement zero trust for IoT:

• Establish strict device and user identity verification using MFA and certificate-based authentication.
• Apply least privilege principles, granting access only to the resources required for a specific task.
• Continuously monitor and analyze traffic, automatically flagging and addressing suspicious activities.
• Utilize encryption to protect data in transit and at rest.

Relevant Link: Zero Trust and Your Organization: What It Will Take to Put Theory into Practice?

The ever-increasing reliance on IoT devices brings an expanding attack surface and the potential for significant security breaches. Security professionals can effectively safeguard their organizations from IoT-related threats by implementing comprehensive strategies that include visibility into device relations, lateral movement protection, microsegmentation, and zero trust. As the IoT landscape evolves, cybersecurity professionals must remain vigilant and adaptable, ensuring that security measures keep pace with technological advancements.

Working towards securing IoT

At TrueFort, we specialize in lateral movement protection and have formed a strategic alliance with Armis, a major asset visibility and security provider. This joint effort enhances our customers’ ability to discover, comprehend, and implement security policies across IT, Internet of Things (IoT), and operational technology (OT) settings.