One of the major concerns with the Internet of Things (IoT) users is to take steps that make sure networks, data, and devices are secured. The IoT device related security incidents have seen an exponential rise recently, and the added worries include teams from IT, security and networking managers that have to entertain similar events that are putting pressure on the network. Jason Taule, Vice President of standards and CISO at security standards and assurance company HITUST added that most of the IoT devices are currently working in the restrictive environment and they are going to be in your midst that cannot be entertained. The question that comes in is how are you going to allow this device to connect and interact with your network, data, and systems?
Here are certain aspects to consider when you’re looking to enhance your IoT device security.
Start with the bottom approach
To build improved security for the IoT devices enterprises need to start with the smallest component for the network infrastructure, that is code added the Laura DiDio Principal at research and consulting firm ITIC. Majority of the IoT devices are very small. Thus most of the code is mostly written in the common tongue such as C or C and C##langauage. The languages are efficient enough, but they lack in security, as they fall victim to common problems like memory leaks and buffer overflow with vulnerabilities. Such issues in the network are equivalent to having common language problems. Most of these errors tend to be more persistent and troublesome, as the IoT environment proliferates and grows bigger, it’s often been overlooked in terms of security errors. One of the best defense to deal with such security threats is test and retest. Many well-adjusted testing tools are available in the market that has been used for IoT devices. Security and IT admins can also use stack cookies; there are randomized data strings that applications are coded to write into the stack just before the instruction pointer register. The data overflows if the data overflow occurs, in case of buffer overflow the stack cookie gets overwritten. The application will be further coded to verify that the stack cookie string will continue to match how the code is initially written. If the stack cookie doesn’t match the application terminates.
Context-aware controls
Controlling access within the IoT environment is one of the biggest security challenges that companies are facing today when connecting with different assets, devices, and products. It includes controlling network access for the connected objects themselves that the organizations should be able to identify the behaviors and activities that are deemed acceptable within the connected things in the IoT environment. Having identified the IoT environment and then putting in place controls that account for this but at the same time, it mustn’t hinder the process. Instead of using the sperate VLAN or network segment that can be added restrictive and debilitating for IoT devices, it implements the context-aware access control throughout your network that will allow appropriate actions and behaviors.
It will ensure that devices can operate as planned with the added ability to conducting malicious and unauthorized activities.
Vendor accountability for IoT equipment’s
Organizations hire all types of providers that provide various services; sometimes, such services are unknowingly rendered to the customers that buy the product. With networking solutions, IoT devices might be connected to the internet, making it vulnerable to hacking and intrusions. Many business experts have added that contracting can be a solution when the vendors are pushing IoT devices in the premises, the need for knowing and seeing that is part of contracting and procurement. Make sure that you knew who is responsible for the updates and lifecycle of the equipment.
IoT identity spoofing
Hackers and their techniques have become more prominent over the years, and they are here to exploit the IoT vulnerabilities. They continuously improve their game with an added strategy of counterfeiting and forgers. The rising use in the IoT devices has led that the attack surface has risen to a greater level, that makes it imperative for the businesses, security and IT teams to verify the identity of various devices that are communicating and connect to the network. All IoT devices have a unique identity, and if the organizations aren’t able to leverage the identity, they are at high risk from getting hacked and spoofed.
Initiating network connections
One of the biggest security risks is the ability of IoT devices to initiate network connections and instead only connect to the network through the firewalls and access control lists. By establishing a one-way trust, quotient means that IoT devices will never initiate the connection to internal systems. That will limit the attacker’s ability to leverage them as they might be used as jump points to explore the attacks. It will, however, not prevent the attacks from happening, but it limits their ability to laterally move within the networks. Enterprises can also force a connection to IoT devices to go through jump host and network proxies. The organizations can inspect the network traffic before coming from and to IoT devices and integrate them effectively. It assists them in determining the traffic and payloads that it accurate, which is appropriate for the IoT device that is recovering or transmitting.
Conclusion
When it comes to IoT solutions, the advancement and innovation are segregated and keeps altering so any security solution will fall short overtime. Having advanced networking security that connects the devices will assist in you, bringing them under control. Developing secured devices that support secured WPA2- enterprises/ 802.1x would mean that putting those devices in their own wireless network, separated from the production network. An enterprise might be having a vending machine that has access to the internet network but is separated from the production network. Having supply chain security as one of your requirements while selecting the vendors will massively impact the security of your device in the journey of production to usage.
To know more, download our latest whitepapers on IoT devices security.
