7 Steps to Improve IoT Security

In today’s interconnected world, the Internet of Things (IoT) is becoming increasingly ubiquitous. With more and more devices being connected to the internet, there is a growing concern about the security of these devices. Cybercriminals are always looking for ways to exploit vulnerabilities in IoT devices to gain access to sensitive data or to cause harm. As a result, it is imperative for security leaders to build a strong IoT security program that includes the following best practices.

The potential economic value IoT brings to society is growing every year, and offering economic value, financial impacts, and transforming modern living. By the numbers, the IoT industry is growing the global economy and providing value in staggering ways:

• 2030: $5-12 trillion estimated to be delivered in global economic value
• 2023: $1.1 trillion U.S. dollars spent on IoT worldwide
• 2019: $104 billion U.S. dollars spent on IoT for Smart Cities

However, as adoption of IoT standards has lagged, enterprises are still working to realize the full potential that IoT can deliver at scale. The economic impact of the Internet of Things will be measured in $trillions. The number of connected devices will be measured in billions. The resultant benefits of a connected society are significant, disruptive, and transformative.

One pressing reason for the IoT trend is to improve security. In fact, over 120 billion U.S. dollars were spent on IoT for IT security in 2019 worldwide. According to a survey of European IoT adopters in 2018 and 2019, 23% said their IoT investments were for security.

Meanwhile, IoT security standards have lagged, as IoT device security presents several challenges. Despite the concerns over IoT cybersecurity, billions of devices online are part of the developing Internet of Things category, and new vulnerabilities emerge every day. As the rising number of connected IoT endpoints offer vulnerable points for hackers to exploit, addressing this challenge requires IoT security to be built in from the ground up, through every layer of the tech stack.

Security leaders can regain control with establishing an IoT security program built on cybersecurity fundamentals.

The Importance of IoT security

The Internet of Things (IoT) is a rapidly expanding network of physical devices, vehicles, home appliances, and other items connected to the internet, making them vulnerable to cyber threats. As the number of connected devices increases, it is crucial for security leaders to build a strong IoT security program that includes best practices to protect these devices from unauthorized access and protecting sensitive data and assets.

Everyday vulnerabilities in IoT are being used for malicious intent – yet most of them are not built for on-going security today. Disparate IoT and lack of IoT asset inventory plague many organizations who do not know what they have connected to the network. Concurrently, remote office issues also arise when there are home IoT connected to the same remote network.

For healthcare organizations, the lack of IoT security includes medical IoT (mIoT). Devices such as kidney dialysis machines, heart monitors, iPads, and more can be categorized as medical IoT – sometimes abbreviated as medIoT. Considering insecure mIoT can get hacked, a healthcare organization must include a proactive IoT security program to fully manage the potential mIoT cyber risks to patient care.

Third Party Security

The IoT connecting to the network needs to be secure – yet along with the many societal, environmental, and economic benefits, the rapidly expanding connected world has introduced a growing attack surface for adversaries to exploit. One of the best risk mitigations for any organization today is only allow trusted third-party IoT suppliers. Considering not all in-house buyers are on the security team, third party security standards for vendor risk management can help prevent risky IoT from being purchased in the first place. These IoT provisions can be detailed in your third party risk management program, which includes the end-to-end security requirements the IoT supplier needs to meet for your digital supply chain security standards.

Considering IoT devices collect and exchange a lot of data, a company should also adopt a cybersecurity risk management framework that incorporates not only technical solutions but also business processes and procedures that fit its environment and compliance requirements.

Building an IoT Security Program

By managing IoT security, security teams can get ahead of obvious IoT security events before they occur. IoT vulnerabilities can be prevented and patched simply and cost-effectively.

With these highlights in mind, these are the seven high level steps that Security Operations and DevOps teams can take to build a strong IoT security program from scratch. Use these essential guidelines to improve IoT security, including IoT security testing and Internet of Things penetration testing.

IoT Risk Assessment

When starting an IoT security program, a critical first step involves conducting a risk assessment to identify potential risks, including assets, vulnerabilities, and threats, and evaluating the risks associated with each.

Before implementing any IoT security mitigations, security leaders should conduct a comprehensive risk assessment to identify IoT assets and risks connecting to the organization systems. The assessment should include identifying assets, vulnerabilities, and threats, as well as evaluating the risks associated with each. One publicly available resource is the IoT Security Assurance Framework. Published by the IoT Security Foundation (IoTSF), a non-profit that publishes IoT security best practice guidance materials, the framework includes a risk assessment template that can be downloaded for assessing IoT risks.

Another essential tool to assess IoT risks is a vulnerability assessment. Vulnerability assessments are an effective way to scan devices and networks to discover potential vulnerabilities that cybercriminals could exploit. An IoT vulnerability assessment would include scanning IoT devices and their connected endpoints and networks to discover and identify the vulnerabilities and security gaps that cybercriminals could exploit. Vulnerability assessments help organizations identify areas where they need to strengthen their security posture as well as create an asset inventory for on-going IoT device management.

IoT Device Management

IoT device management is critical to IoT security. One of the biggest challenges of IoT device management is the sheer number of devices that need to be managed. Organizations must ensure that all devices are registered and authenticated, and that firmware updates and patches are applied regularly. Failure to do so could leave IoT devices vulnerable to attack. IoT device management involves registering and authenticating devices, keeping an asset inventory of IoT devices, applying firmware updates and patches, and decommissioning devices when they are no longer needed.

Using the asset inventory created in the vulnerability assessment phase, organizations can benchmark progress for managing both IoT security and the asset inventory moving forward for IoT device management. An external attack surface management (EASM) solution can help organizations maintain the asset inventory by scanning continuously to detect and add devices for on-going monitoring. EASM can scan and detect newly connected IoT devices that then get added to the asset inventory for on-going device management.

Network security is equally critical for IoT security, and involves network segmentation, firewalls, intrusion detection/prevention systems, access controls, and encryption.

To fully protect the network from IoT cyber attacks, the network must be segmented to limit impacts to the organization’s most valuable data and central command and control. Network segmentation involves dividing networks into smaller segments to make it more difficult for cybercriminals to gain access to critical systems. Firewalls and intrusion detection/prevention systems can help detect and block unauthorized access attempts. Access controls can limit access to critical systems and data, while encryption can protect data in transit and at rest.

Data Security

Protecting the data generated by IoT devices is another essential aspect of IoT security. IoT devices can leak private user data via their cloud-based applications and while in transit. To manage data security and compliance requirements, priorities include data classification, backup and recovery, encryption, and secure data storage. Highly regulated environments will require routine penetration testing to ensure data security meets requirements, such as HIPAA pentesting or PCI DSS pentesting.

Data classification involves categorizing data based on its sensitivity and value. This can help organizations prioritize their data protection efforts. Backup and recovery procedures should be in place to ensure that data can be recovered in the event of a cyber attack. Encryption can help protect data in transit and at rest, while secure data storage can prevent unauthorized access to sensitive data.

With recent threats putting redundancy mechanisms like data backups and system recovery at risk, routine security testing should be included to ensure data recovery plans will actually work as expected during an real cyber event.

Security Awareness Training

When it comes to IoT security, security awareness training should cover the rules regarding connecting a personal IoT device to the company network. Considering that IoT is subjected to security policies, users should know that personal IoT devices are typically prohibited from connecting to the company’s network, assets, or infrastructure to minimize IoT risks.

When conducting security awareness training on IoT cybersecurity policies and procedures, instructions can be tailored for both technical and non-technical employees. Technical employees may need SecOps or DevOps security awareness training to meet compliance requirements. Considering phishing and social engineering scams can also lead to hacked IoT devices, security awareness training should include phishing simulations to help users identify phishing emails and text-based scams, and how to report them.

Incident Response Plan

Even with the best security measures in place, incidents can still occur. Having a well-documented incident response plan that includes roles and responsibilities, testing and revision, and communication and coordination procedures is essential.

The incident response plan should include procedures for detecting and responding to cyber attacks. It should also include procedures for containing the attack and for recovering from the attack. Tabletop testing of the IR plan should be conducted regularly to revise it and ensure its effective for the top use cases that the organization could face if impacted by a breach event. Red teaming is an ideal method for incident response plan testing – revealing visibility into potential attack paths and security weaknesses across systems in addition to refining the IR plan itself.

IoT Penetration Testing

IoT penetration testing is a critical component of a strong IoT security program. It involves simulating an attack on an IoT device or network to identify vulnerabilities and weaknesses. By conducting IoT penetration testing, security leaders can identify potential risks and take steps to mitigate them.

To ensure that IoT penetration testing is effective, there are several best practices that security leaders should follow to ensure comprehensive results. These include identifying the scope of the test, using the right tools and techniques, and ensuring that IoT pentest is conducted by qualified security professionals. Continuous vulnerability monitoring and on-going IoT testing is necessary to stay ahead of evolving IoT-related risks and emerging IoT device vulnerabilities.

Third Party IoT Pentesting

As security teams are busy with investigating alerts and triaging remediation tickets with DevOps, a third party penetration testing provider can relieve in-house teams and accelerate IoT penetration testing and Internet of Things cybersecurity testing. With a trusted pentesting partner, you can conduct IoT pentests with an unbiased, credentialed third party provider who can test specifically for your unique security and compliance requirements. A third party pentester will report back on critical IoT vulnerabilities and compliance findings. The right pentesting partner will work in concert with your in-house team to remediate IoT vulnerabilities.

Build Your IoT Security Plan with BreachLock

Building a strong IoT security program is essential to protect an organization’s data and assets. By implementing these best practices, security leaders can reduce the risk of cyber attacks and ensure that their IoT devices are secure.

With BreachLock’s award-winning, analyst-recognized cloud platform and in-house, expert-led IoT penetration testing, you can get expert support to meet the essential requirements that you need for IoT pentesting. When you work with BreachLock’s certified IoT penetration testers, you can experience a seamless experience and get audit-ready, action-orientated results fast to certify your IoT device security and full stack systems. Schedule a discovery call today.