The most common exploitations of internet-connected devices typically involve either conscripting thousands of vulnerable IoT devices into botnets or gaining access to a network through an exposed IoT device for ransomware attacks. I was interested to read that researchers from IoT security firm Senrio have recently shown that a company’s publicly exposed IoT devices can be used as an unsupervised backroad into networks. Consequently, cyber attackers can jump from one vulnerable IoT device to the next, bypassing conventional devices such as PCs and servers, which makes the intrusion considerably more difficult to detect.
“We were seeking to answer the question ‘why does one device matter?’” M Carlton, Senrio’s vice president of research, says in a Wired article. “An attack like this shows why it’s important to know what’s really on your network. These devices are all connected to each other and can create a hole in the network. It would be very difficult to catch this.”
IoT-based attacks are also growing. A recent CEB, now Gartner, survey found that nearly 20 percent of organizations reported at least one IoT-based attack in the past three years. To protect against those threats, Gartner now forecasts that worldwide spending on IoT security will reach $1.5bn in 2018, a 28 percent increase from 2017 spending of $1.2bn.
“Interest is growing in improving automation in operational processes through the deployment of intelligent connected devices, such as sensors, robots and remote connectivity—often through cloud-based services—however organizations generally don’t have control over the source and nature of the software and hardware being used by smart, connected devices,” says Ruggero Contu, research director at Gartner. “We expect to see demand for tools and services aimed at improving discovery and asset management, software and hardware security assessment, and penetration testing. In addition, organizations will look to increase their understanding of the implications of externalizing network connectivity. These factors will be the main drivers of spending growth for the forecast period with spending on IoT security expected to reach $3.1bn in 2021.”
Despite the steady year-over-year growth in worldwide spending, Gartner predicts that—through 2020, anyway—the biggest inhibitor to growth for IoT security will stem from a lack of prioritization and implementation of security best practices and tools in IoT initiative planning. This will hamper the potential spend on IoT security by approximately 80 percent.
“Although IoT security is consistently referred to as a primary concern, most IoT security implementations have been planned, deployed and operated at the business-unit level, in cooperation with some IT departments to ensure the IT portions affected by the devices are sufficiently addressed,” Contu says. “However, coordination via common architecture or a consistent security strategy is all but absent, and vendor product and service selection remains largely ad hoc, based on the device provider’s alliances with partners or the core system that the devices are enhancing or replacing.”
The absence of “security by design” comes from a lack of specific and stringent regulations. Going forward, Contu expects this trend to change, especially in heavily regulated industries such as healthcare and automotive. Indeed, by 2021, Gartner predicts that regulatory compliance will be the prime influencer for IoT security uptake.
What are your thoughts on IoT device security? Do you believe companies in heavily regulated industries will be the ones driving security architecture for IoT devices?