By Ian Parker, professional services consultant, Axians UK
It’s useful to think of your business as a castle with strong perimeter walls, no windows and a single impenetrable gate. Your business’ sensitive information, personnel and data are, in theory, all protected from the dangers of the outside world.
In this context, connecting to the internet is the same as allowing trusted personnel in and out of the gate with guards validating them as they come and go. With unsecured Internet of Things (IoT), the castle is exposed by creating multiple doors all the way around the walls, allowing unrestricted access from the outside. You have now turned your castle into a tourist attraction, potentially allowing anyone in the world to come and enter through multiple entrances.
By the same token, using internet connected devices in business safely and correctly will provide considerable advantages to productivity, communication, operation and visibility and this should be harnessed. There are many business devices that could benefit from being connected to networks.
Security alarm bells
A notable obstacle to security is that some companies that want to use network-controlled devices are not technology aware. Approximately 50% of employees think that their IT department (if they have one at all) is not aware of all the company’s connected devices, and around 70% perceive their organisation as being at risk from a connected device related security issue [The Security Impact of Mobile Device Use by Employees 2014, Ponemon Institute]. It has been predicted that 20 billion connected devices will be in circulation by 2020, so the problem must be addressed and rectified before it gets out of control and risks global security.
Potentially all these devices, if not secured, are open doors for any malicious organisations or individuals to gain access to internal networks or the device itself.
Once the hacker has access to the device, it can be used to attack a targeted company in a DDoS attack, or they may even be able to hack into the internal network devices, leading to full control of your business environment. The outcome of the scenario may depend on where the hacker’s motivation lies; we have seen countless examples of hacktivist attacks, causing disruption or mayhem to a company to prove a point or to bring attention to the company’s inadequate security defences. Or more menacingly, they could be a cyber criminal, part of an organisation whose sole purpose is to obtain money via ransom, credit card theft and identify theft.
But how can this happen? For a device to be accessed via the internet, it must have an address that the internet knows about (a public IP address). If a device is configured with a public IP address it can therefore be seen and accessed by the connected world. Without the device manufacturer securing it, by means of closed ports or source address filtering for example, a would-be hacker could access the device with little effort. In addition, if an employee without technical knowledge has installed the device, it is likely that the security credentials remain the default ones, which a hacker can find with ease in the manufacturer’s online user guide.
Securing business IoT is simple (if you know risks and vulnerabilities and can prevent them). In short, IoT is only as secure as you make it. In today’s market, you cannot rely on manufacturers to produce a network-controlled device with security at the forefront. Unless the IoT device is a security device in itself, the manufacturers will want to make it as cost-effective as possible with a quick production cycle. Security, on the other hand, is time consuming, costs money and is not widely understood.
Businesses must therefore ensure that their deployed network connected devices are protected and only accessed by authorised sources. In addition, as the intensity and growth of the device connected world continues exponentially and uncontrollably, the current version of the Internet Protocol (IPv4) will not be sufficient to sustain the number of devices needed to connect to the internet natively. It is inevitable that the next generation of the Internet Protocol (IPv6) will be used for these additional connected devices, which in itself integrates a lot of security features that will reduce the risk and vulnerability of the device. However, most non-technical companies in the world don’t know what IPv4 is, let alone IPv6.
Axians provides a comprehensive portfolio of solutions: software solutions, cloud-based and managed IT services, data systems and data centres, enterprise networks and digital workspace, telecommunications infrastructures.