IoT Security: A Winning Strategy for MSSPs

The rapid growth of the Internet of Things (IoT) has vastly expanded cybercriminals’ attack vector options. Millions of connected devices — many of them lacking basic security features or that are deployed using default passwords — have provided new gateways into networks around the world, in homes and businesses alike.

In 2016, a large-scale Mirai botnet DDoS (distributed denial of service) attack was launched. This attack was partly enabled by poorly protected CCTV cameras that were connected to the internet. It took down a significant chunk of Internet access on the east coast of the United States.

To rush items to market, many manufacturers (particularly on the consumer side) configure devices with weak (or no) security credentials. To demonstrate the nature of these threats, Barracuda Labs recently conducted tests on an IoT security camera.

Cyber criminals can leverage vulnerabilities in the web and mobile applications used by IoT devices to acquire credentials, which can be used to control the device or read account information. Attackers can also use those credentials to load their firmware and repurpose a connected device to attack other devices on the network.

These attacks rely on functionality that allows users to share device access to the connected camera with other users. As a result, the devices can be compromised without any direct connection to the device itself.

There have been some efforts to legislate improved security in IoT devices. Congress introduced the Internet of Things Cybersecurity Improvement Act of 2017 to set standards for IoT devices sold to the federal government. The bill includes requirements for patches and updates, password coding, and other features. Unfortunately, it never became law — it’s still in review.

California, meanwhile, has passed an IoT cybersecurity law that goes into effect in 2020, requiring manufacturers to equip devices with “reasonable” security features. Additionally, IoT devices that are outside of a local area network must be configured with a ‎unique password or allow the user to generate a new ‎means of authentication before using it.

A Multi-faceted Security Problem

Passwords are only part of the problem. Since legislation and standards are still in development and many IoT devices come from a variety of different countries and manufacturers, MSSPs will need to protect their customers by helping them “harden” their IoT investments.

Since clients may be deploying these solutions on their own or with other providers, it’s vital to conduct a review and have a conversation about how connected devices can impact security. After that, there are a few additional strategies that can help:

Your clients may already have IoT-enabled devices on their networks, and the number of devices will only increase moving forward. By taking a proactive approach to including IoT devices in your security program, MSSPs can play an instrumental role in educating clients, preventing network breaches and providing better service.

 Chris Crellin is Senior Director of Product Management for Barracuda MSP, a provider of security and data protection solutions for managed services providers, where he is responsible for leading product strategy and management.

This guest blog is part of a Channel Futures sponsorship.