To IOT or NOT IOT management could be a problem?

As we venture deeper into the digital age, the Internet of Things (IoT) is reshaping our world. From smart homes to intelligent business operations, IoT devices are becoming ubiquitous. However, this rise brings with it the challenge of security. A lot of companies are choosing IOT devices to manage the lighting and heating to reduce the environmental impact of the company. Intelligent power management to turn off areas of the company outside of hours or movement sensors on the lights.

One issue with these devices is that not every vendor made security a priority when they produced them, and some major attacks have happened by exploiting these devices.

Remember the Mirai botnet from 2016 that was used to DDOS several companies? Devices were compromised because of the use of default usernames and passwords in the software, they were discovered when the malware scanned the internet for Universal Plug and Play (UPNP) being the default setting. When turned on it allows network discovery and connections to be made to the device and saves creating port forwarding rules on the ISP routers but bad for security. My advice to anyone who reads this is to look at that setting as your network on your ISP router. I switched mine off a few years ago but I always have to check in case new software has turned it on again.

We have multiple IOT devices in our house, such as lights that we can switch on and off remotely, doorbells that we can respond to when we are away, cameras that monitor the house, and devices that play music. We even had a power plug that we use with the Christmas tree.

The downside to all this technology is that we are relying on the vendors to secure it and there is no management. I have mine on a separate service set identifier (SSID) just in case and the Camera system is hard-wired, but I still wonder how vulnerable it could be as it’s Linux inside which we have no control over. I doubt there is any protection on the device other than the core functionality.

At home it’s different, but this does raise the question of whether a business can afford to take the risk of an unmanaged device being on its network. While it might be fun to turn the lights on with a voice the traditional switch is hard to compromise.

The cost of incident response is only getting higher with the risks being so vast and incidents becoming more mainstream. The government has released the following article about a code of practice for business, view here (Cyber Governance Code of Practice: call for views – GOV.UK (www.gov.uk)).

It might be a good idea for our community to have some structure as many companies have differing controls on data as you see the companies that need incident response. Management and control of devices are key, should a user lose a phone or a laptop they can be remotely wiped, and the data is gone but with IOT these devices need management and control, especially in regulated environments.

For businesses that choose to use IOT devices, a management and control platform should be considered. An example is Cisco DNA spaces which helps to isolate devices onto separate networks and monitor traffic/behaviours for signs of compromise. Devices can be isolated in separate networks, preventing attackers from accessing critical segments. Access controls ensure that only authorised devices and users have network access whilst leveraging Cisco’s Threat Intelligence DNA Spaces proactively counters emerging cyber threats.

As IoT technology evolves and more businesses adopt the technology, so does the potential of Cisco DNA Spaces. With AI and machine learning, the platform promises automated, intelligent decision-making based on real-time data. Cisco DNA Spaces comes into play, offering not just connectivity and insights but also robust security measures to protect against IoT threats. Extending Cisco’s networking infrastructure to interpret data from Wi-Fi-enabled IoT devices, turning them into actionable insights for operational efficiency, enhanced customer experiences, and improved safety.

If you have other existing products like Cisco AMP and ISE, DNA Spaces provides an added security layer to help monitor and maintain safety standards for regulatory compliance.

Cisco DNA Spaces is more than a connectivity platform; it’s a comprehensive solution for the modern IoT landscape, offering efficiency, insight, and, importantly, security. In a world increasingly reliant on IoT, Cisco DNA Spaces stands as a beacon of innovation and assurance. With the rise in attacks of malware examples such as Mirai protection will become a concern for all companies using IOT devices.

With all the breaches that have occurred do you want an IOT device to be the cause of a data leak from your environment? Get in touch to learn more