7 Biggest IoT Security Challenges and How to Fix Them
IoT products & services have exploded in 2021 so far. People are surrounded by IoT devices, such as IoT cars, smart refrigerators, and other smart home products, exchanging data through connected sensors. There are even smart machines now, networking in every industry right from manufacturing to retail.
The ubiquity of these connected devices is overwhelming and the amount of data being transmitted will only continue to rise. As per a report by Gartner, 5.8 billion automotive and enterprise gadgets were reported to be on IoT by the end of 2020 and there are expected to be more than 64B IoT devices worldwide by 2025. As per Mckinsey Global Institute, the entire IoT industry has the potential to generate $4T to $11T in economic value by 2025.
However, this large magnitude of growth comes with its share of cyberthreats. No matter if it’s as large as a manufacturing robot or as small as an electronic chip – without security, every IoT device can be hacked. The more astonishing fact is that it can only take five minutes for an IoT device to be attacked.
Thus to protect the IoT ecosystem, organizations need to develop a thorough understanding of IoT cybersecurity, its challenges, and strategies to mitigate the risks. This not only protects businesses against threats but also helps build confidence in the digital transformation process.
Through this article, iLink Digital aims to help the readers review the 7 significant IoT security challenges and how to fix them.
Top IoT Security Challenges and Solutions
- Poor compliance from Manufacturers
This is one of the main security issues with IoT devices. Even a small device as a fitness tracker can expose Gmail Login credentials if it lacks compliance from the manufacturer’s side. Since there are no universal IoT security standards, there’s not security policy to stop manufacturers from working on the next product instead of providing updates for the old one. Even if they provide updates, it lasts for a short time.
Solution: Thus to protect consumers against attacks, each device should be tested before launching and updated regularly. In fact, companies should make security a crucial element in their product design process. Other measures that manufacturer can take are-
- Use quality hardware and firmware
- Use updated operating systems and software
- Secure data transfer and storage
- Encourage users to use strong coded passwords
- Provide them with regular automatic updates
- Lack of awareness among users
IoT is a growing technology and people are still new to it. They might have learned to protect their emails and personal computers with strong passwords, but securing a connected device is still alienating for most users. The reason for this is insufficient knowledge and awareness regarding IoT functionality.
As per Palo Alto Networks, 98% of all IoT device traffic is unencrypted, exposing personal and confidential data on the network. This allows attackers to collect personal or confidential information and then exploit it for dark web profits.
Solution: Since IoT involves consumer-oriented applications, it’s important to provide them with adequate knowledge on how to use these products.
A few of the principles that users can follow are –
- Changing default passwords and usernames.
- Changing them regularly every 30 to 90 days.
- Using multi-factor authentication to increase the level of security
- Keeping software updated, and
- Using secure internet connections
- Lack of Physical Hardening
Physical hardening is one of the important aspects of IoT security. Since IoT devices operate autonomously without any human intervention, they need to be secured physically from threats. Such attacks may not be intended to damage the device but rather extract information from it. Even a microSD card can be a goldmine for the attacker revealing all the private data and passwords.
Sometimes these devices are used in insecure locations for long periods, making it easier for hackers to tamper them and go undetected. A single hardware attack can stop the IT (Information technology) and OT (Operational Technology) elements to stop interacting with each other, jamming the whole system. Thus protecting your hardware from any kind of manipulation is important for both consumers and industrial control systems.
Solution: Ensuring the physical hardening of an IoT device begins with the manufacturers. However, users are equally responsible for keeping IoT devices physically safe. One way to do so is to keep keys in Trusted Platform Modules (TPMs) and Trusted Execution Environments (TEE). TPM is a chip installed near the CPU on an IoT device. It’s mostly used for cryptographic operations like generating a security key, saving it, storing data, and so on.
- Botnet Attacks
A botnet is a network of connected devices hijacked by malware that allows hackers to carry out various scams. These bots serve as a tool to automate mass attacks such as unauthorized access, server crashing, data theft, and DDoS (Distributed Denial of Services) attacks.
The most popular example of a Botnet Attack is the Mirai botnet attack in 2016, which left much of the internet inaccessible on the U.S east coast. Since then it has been a constant threat to IoT security. The hackers exploited consumers’ default-itis by scanning hundreds and thousands of routers for exposed telnet ports. They brought down the DNS (Domain Name Server) that provided services to platforms like GitHub, Twitter, Reddit, Netflix, and Airbnb.
Botnets are usually built to grow, automate and speed up an attack with little cost and time invested. Hackers can remotely access devices and infect other tons of machines to carry out an attack efficiently. It can become extremely difficult for security technology to distinguish between legitimate traffic and hostile traffic.
Solution: The following steps are recommended to protect IoT devices against botnet attacks right from production to retirement,
- Make sure your IoT device has built-in security features – into architecture, interfaces, and designs.
- Create a separate network solely for your IoT devices. Also, use intrusion prevention systems as a third-party firewall.
- Use the router’s built-in security features to protect all devices in that network.
- Disable unused features.
- Use comprehensive security software.
- Ransomware Attack
Ransomware is one of the nastiest malware types practiced by hackers. They do not destroy sensitive files or data but instead holds the victim’s information at ransom to demand money. This practice is evolving and IoT devices with poor security can be easily targeted. Unprotected IoT devices such as wearables, healthcare gadgets, smart home products, and other smart equipment are at a risk in such attacks.
These devices collect, transmit, and process user’s information to the cloud. Sending data without any encryption can risk the entire device functionality. On an industrial level, this data can expose the entire business and even allow hackers to make changes to data without being noticed.
Solution: The best practices to prevent such attack are –
- Conduct mini risk assessment
- Carefully read the privacy statements
- Have a recovery plan
- Use different passwords for every internet-connected device
- Deactivate your device when not in use.
- Rogue IoT devices
Employees usually bring their own IoT-connected devices to the workplace. If these personal devices are not secured they can risk the entire organization, exposing it to cyberattacks. As per Inflobox, 46% of the organizations have discovered ‘shadow’ IoT devices on their network during the last year. Only one-fourth of the company confirmed that no shadow IoT devices were present on their network.
Additionally, the enterprise security teams aren’t always aware of these extra devices connected to the network. The problem is not limited to only BYOD (Bring-Your-On-Devices) approach in enterprises but also in the home networks. Personal devices are easily discoverable by cybercriminals and can act as rogue devices. Such devices are plain malicious by nature and exist for the sole purpose of stealing sensitive data.
The Raspberry Pi or the WiFi Pineapple are two examples of rogue IoT devices. These can be modified to act as a rogue AP (Access Point), thermostat, video camera, or MITM (Man in the Middle) and retrieve all the incoming data connections without the users’ knowledge.
Solution: To protect against such rogue gadgets, the following precautions are recommended,
- Restricting who can physically connect to your network infrastructure should be the first line of defense.
- Identify the authorized devices that connect to the network and ensure it’s free from any suspicious or unknown web traffic.
- Create a whitelist of devices. Only these devices will be able to connect to the network.
- Monitor network access for performance, capacity, and compliance.
- Crypto mining with IoT bots.
Another IoT security challenge is protecting them from the botnets that not only infect home routers and other Internet of Things but also attempt to mine for cryptocurrency. These hijacked devices allow criminals to rake in crypto-cash while the device owners remain unaware that their gadgets are being used to produce crypto coins.
In February 2019, more than half a million computing devices were hijacked by a cryptocurrency miner botnet called Smominru, forcing the various devices to mine nearly 9,000 Monero crypto coins without the knowledge of the owners of the devices, according to technology portal ZDNet.
Solution: These botnets are usually released on a private network of interconnected computers as it empowers their computational process for mining cryptocurrency. Given its distributed nature, taking down botnet is very difficult. The best protection from infection is robust patching regimens and layered security. Another potential solution is Blockchain IoT security, which is most familiar for bitcoin and Ethereum.
Blockchains contain strong protections against data tampering, locking access to the IoT devices, and only allowing whitelisted devices into the network. This way, it creates a permission private network, specifically designed for IoT security.
Winding Up
Visibility into IoT device networks is crucial for businesses. Yet fewer than 42% of organizations can identify insecure IoT devices. Though there are countless ways to secure your IoT network devices, start with the least complex measures to minimize the risk. Looking at the nature of potential threats, you can adopt more intensive solutions.
iLink Digital offers full-range IoT services to help organizations implement reliable and cost-effective IoT solutions. We have been helping our clients to solve their business challenges and tap into new revenue streams via IoT technology.
Read about our work in detail.
What IoT solution are you looking for?
Page Break
Endnotes
2. https://www.statista.com/statistics/471264/iot-number-of-connected-devices-worldwide/
5. https://info.infoblox.com/resources-whitepapers-whats-lurking-in-the-shadows-2020
6. http://www.zdnet.com/article/a-giant-botnet-is-forcing-windows-servers-to-mine-cryptocurrency/
7. https://sharedassessments.org/blog/a-new-roadmap-for-third-party-iot-risk-management/
