By Jean Turgeon
With projected market revenue of $1.7 trillion by 2020, as estimated by the Wall Street Journal in 2015, the Internet of Things (IoT) stands to forever change the world as we know it. Leaders can create a vertical-driven strategy that produces positive and proactive business outcomes but strategy won’t take business far, if it doesn’t explicitly address the unique security threats that are inherent to the increased level of connectivity.
These kinds of threats aren’t easy to identify or mitigate, which is exactly why nearly 60 percent of companies say they plan to “eventually” implement the IoT (i.e. once security no longer concerns them) and why nearly 30 percent have no plans to implement the IoT at all as suggested by Gartner, but this is likely to change quickly.
With the number of connected “things” growing, it is expected that more hackers will feed off the ever-growing possibilities to attack, threaten and compromise business. Consider the recent IoT-driven DDoS attack on Internet performance company Dyn, which disrupted websites like PayPal, Spotify and Twitter. As reported by the Washington Post in October 2016, Dyn’s Chief Strategy Officer admitted that some of the traffic that attacked the company came from compromised IoT devices.
3 IoT security threats to address
Personally-owned devices: Research by Gartner shows that about 40 percent of US employees at large enterprises bring their own device(s) to work, and 75 percent of companies, as estimated by Technoproresearch currently permit or plan to permit BYOD in the workplace. Today, there’s a clear need among businesses to securely connect these personally-owned devices that simultaneously perform multiple functions and connect to public, private and hybrid clouds. It may be easy to secure enterprise IoT, but this gets a lot trickier when companies factor in the devices employees are using on their network. Just consider the 10 million Android devices that were infected this summer with Chinese malware. My suggestion: There is a need to implement some sort of malware detection mechanism and deliver some level of automation that can quickly detect abnormalities on employee devices and prevent them from spreading.
Open APIs: An open API model is advantageous in that it allows developers outside of companies to easily access and use APIs to create breakthrough innovations. At the same time, however, publicly available APIs are also exposed ones. Promoting openness means anyone can write new APIs (which is a good thing), but that can cause some challenges in the market. If an organization has undocumented features of its API, for instance, or if someone is rolling out an API and doesn’t have it properly documented or controlled, hackers can potentially take advantage. At the end of the day, businesses must be cautious as to what is being exposed and documented when writing APIs.
Influx of Data: The amount of data being gathered from today’s ever-growing number of connected “things” is simply astounding. In fact, a BBC research shows that about 90 percent of all data in the world today was created in just the past few years (2.5 billion GB of data were being produced every day in 2012 alone!) While big data has the potential to transform internal processes and the customer experience, leaders must ensure they have the right infrastructure in place to securely distribute and store the massive amount of data that flows through their organization daily. An organization should have a solid understanding of how much data their network can handle (never overestimate network capabilities) and plan to scale accordingly. Also, organization should be aware of the origination of their data and privacy regulations related to industry in which they operate. Healthcare, for example, must abide by very strict regulations. Be sure to also keep in mind the legality of where the data is stored, depending on where that data comes from. Countries like Germany, for instance, have strict privacy laws that others don’t.
The one thing to remember
One important thing business leaders must keep on top of their mind: although the possibilities for data compromise are growing, they’ll never become realities with security solutions offered from the right provider. This doesn’t mean your security concerns aren’t valid; it simply means that, with the right technology, there’s no longer a reason to let those concerns prevent companies from tapping into the immeasurable growth brought about by the IoT.
Organizations should consider a layered approach:
Phase I: Analyze, monitor and inspect.
Phase II: When classifying device as suspect, isolate to different segment and perform forensic analysis.
Quarantine device, if known malware is detected and identified.
If unknown/unidentified, maintain isolation in “honeypot” (quarantine zone to understand malware) and deploy counter measures as soon as possible once fix becomes available.
Phase IV: Once malware is clearly identified, quarantine all devices potentially infected while informing end users / LOBs impacted.
*Note: For Phases II and III, invoke an automated sophisticated workflow to notify the right team for just-in-time analysis.
To properly execute on these phases, companies need an automated and more secure networking foundation. The legacy client-server is simply not suitable for this new IoT world. Whatever services the connected devices or systems provide, do whatever to ensure they are logically segmented on the infrastructure. This is something that can be achieved through end-to-end network segmentation.
An end-to-end network segmentation solution eliminates nodal configuration by leveraging end-to-end Virtual Services Networks (VSNs). This allows businesses to provision their networks only at specific points of service, where those services are being consumed by end users or device(s). Ultimately, end-to-end segmentation transforms the network core into an automated and intelligent virtualized transport. Your company’s network segments will be stealth to hackers, flexible for secure, authorized use and truly isolated from one another. These core capabilities near-guarantee network security no matter what devices employees are using, how much data they are generating and sharing, or what APIs are being written.
In the end, your company’s network security strategy will never be effective if their underlying architecture isn’t what it needs to be. End-to-end network segmentation is the most effective way to minimize and control the inherent security risks of the IoT. And the best news is there are end-to-end segmentation solutions proven to deliver next-generation IoT security — even for companies still leveraging aging infrastructure. The technology is possible, real and waiting to be utilized.
As we move forward with the IoT, we must ensure security is always top of mind. There are a set of best practices that organizations must implement to substantially reduce the risks associated with IoT deployment. Keep in mind, there are no immune systems, but understanding the risks and minimizing the potential business impact is key. In the end, status quo will likely be a disaster for organizations endorsing the IoT at a rapid pace; changes to legacy practices and infrastructure are a must! Thankfully, technology advancements can provide the connectivity, stability and security required to enable companies to take advantage of the opportunities provided by the IoT.
The author of this article, Jean Turgeon is Vice-President & Chief Technologist Software Defined Architecture, Worldwide Sales, Avaya Inc