How to Mitigate IoT Security Risks

By Gary Hayslip

Gary Hayslip

The question for this edition of “Ask the Security Expert” comes to us from Jaymes Alvarez of IMT Services Corp., who asks, “How do you mitigate the security risks of IoT?” It’s a great question – and one that so many organizations have contemplated for years. As any organization knows, great connectivity comes with great responsibility.

As we think through steps to mitigate the security risks associated with the IoT, it’s important to be aware of the potential dangers users may be exposed to – and from there, take the necessary steps to minimize the risk. Given recent hype and the security risks associated with the IoT, it’s clear that more work needs to be done to better protect the security of connected devices.

Today’s IoT devices are used across almost all industries, including all the big players such as manufacturing, agriculture, health care and energy. If a cyberattack were to affect one of these industries, it could potentially take down the operations of an entire country or business.

Unique IoT Challenges

Let’s take a look at the health-care industry. In terms of vulnerability, this industry is very high on the list as it’s in the business of protecting human life. Medical professionals will forever remember the WannaCry attack that wreaked havoc on hospitals around the globe and crippled their computer systems.

Making matters worse, last year the FDA confirmed that St. Jude had used implantable cardiac devices on patients, such as defibrillators and pacemakers, that carried a vulnerability that would allow the device to be hacked. The sheer thought of someone being able to “hack your body,” especially a major organ, is terrifying. Imagine the outcome if a sitting president or world leader was to need such a device and it was comprised by another attacking country. That’s just two examples of how critical it is that we work to make sure that we protect the security of IoT.

It was evident to me during my previous role as the CISO of San Diego and now as a CISO for a leading cybersecurity company that smart city networks pose a unique challenge to the industry, as they are comprised of a mix of legacy and new technology working together. Although we value these streamlined connections, they also can leave the network open to serious risk as these systems are often connected to larger integrated networks. If compromised, they can act as a key to grant access toward even larger security incidents. For example, a standard phishing email targeting an unexpecting network administrator could compromise an entire network if the correct controls are not in place to stop ransomware from spreading.

In the consumer landscape, IoT devices consist of smart speakers and TVs, wearables, routers, appliances, etc. Aside from being the new home trend amongst the tech-savvy crowd, they generally work to make our lives a little easier. Devices such as Amazon Alexa or the Google Home are popular and can be connected to several aspects of your life ranging from a user’s personal calendar to music, mood lighting and more. Another popular consumer IoT device is the smart door lock, granting users the ability to safeguard their homes from far away – several of which come with the added protection of a security camera and a speaker box for communication purposes. If hacked, these smart locks would instead function as a high-tech key, compromising the user’s home security and literally opening their front door to threats.

Cyber-Hygiene Training Is Key

To best defend against IoT risk, organizations need to follow basic cyber-hygiene best practices and continually monitor for changes. This includes network segmentation, patch management, backups, data encryption and employee education programs – all of which need to be done on a regular basis. Needless to say, any employee or contractor with access to an organization’s networks should go through extensive and regular security awareness training in several key areas:

As the use of IoT increases, it’s imperative that we work to make sure that all devices are secure, and both education and using our best cyber-hygiene will be the key to making sure that we are safe. Unfortunately, there isn’t a silver bullet to protect all IoT devices, but as users we can do our best to be sure we’re checking all the boxes we have at our disposal

Gary Hayslip is responsible for the development and implementation of all information security strategies, including Webroot’s security standards, procedures and internal controls. As CISO, he also contributes to product strategy to guide the efficacy of Webroot’s security portfolio. He previously was CISO of the city of San Diego and held infosec roles with the U.S. Navy and the federal government. Follow Hayslip on Twitter @ghayslip or on LinkedIn.