How to Safely Introduce IoT Devices to Your Business Network
The Internet of Things (IoT) landscape is currently changing businesses and their willingness to adopt new technologies. As we anticipate nearly 20 billion connected devices on the market by the end of 2025, from smart sensors to connected heavy machinery, we can expect IoT products to transform capabilities and offerings, bringing efficiencies and innovation to the workplace.
However, these devices also introduce significant cybersecurity risks. The 2021 Verkada breach, where cybercriminals accessed live feeds from 150,000 security cameras, proves the risk of damage when IoT devices are compromised is severe. Regardless of whether it is due to default or weak passwords, a lack of firmware updates, or unprotected communications, if you do not implement proper security controls, your business could incur a data breach, a cyberattack, or an operational disruption when an IoT device behaves unexpectedly.
The purpose of this article is to provide IT managers, business owners, and security professionals with seven actionable steps to safely deploy IoT devices on their networks, assess the benefits offered by these devices, and maintain an adequate level of protection.
Why Security is Important with IoT
Just as IoT devices have powerful capabilities, they inherently lack or have inadequate security controls, which makes them an easy target for cybercriminals. A 2023 research study published by Cybersecurity Ventures estimated the global costs of cybercrime to be $8 trillion, also predicting that IoT devices would become an increasingly popular target for attacks. A single compromised device can lead to data breaches, loss of operational time, damage to reputation, or financial penalties, depending on the requirements, regulations, or standards that were violated, such as GDPR, HIPAA, or CCPA. Prioritizing security and controls will provide business value when it comes to realizing the true potential that IoT devices can offer. Here are seven helpful steps to accomplish this.
Steps to Secure IoT Implementation
1. Create an IoT Plan
Collaborate with the business to ensure that IoT implementations align with the business purpose, while also evaluating any security risks that need to be addressed.
Clearly defined goals, such as optimizing supply chain operations or accelerating the Customer Experience (CX), should be established. Evaluate the sensitivity of data and determine how it should be protected. Ensure that the devices you want to deploy support secure protocols (TLS version 1.3). Conduct a risk assessment to identify the vulnerabilities, consider using the Cisco IoT Control Center, and understand how devices interact with each other from a security hygiene standpoint.
2. Isolate Your Network
Keeping IoT devices separated from more sensitive systems or networks can help limit the damage if an attacker breaches your defense.
Implement a virtual local area network (VLAN) to isolate your IoT devices from servers and workstations. Then, write your firewall rules to limit traffic to the absolute minimum necessary for the device to operate. This could mean allowing access only to vendors’ systems, such as those from Palo Alto Networks. If the device is truly inconsequential, such as a smart TV, connect it to your guest Wi-Fi, which allows even further reductions in permission.
3. Assess Vendors and Devices
Devices are often poorly engineered, and vendors are not always secure. Therefore, it is crucial to assess vendors thoroughly.
Choose reputable vendors like Cisco or Siemens, who offer strong encryption (AES-256, TLS 1.3) and regularly updated firmware. Check if your devices have any open default passwords, and provide privacy policies publicly and unobscured. One advantage is that it minimizes the risks associated with the deployment of poorly engineered and insecure devices.
4. Enforce Strong Authentication and Access Controls
Weak authentication is a straightforward method for an attacker to gain entry to devices that have been inadequately protected, as well as those with some security measures in place, as the Verkada breach can attest. Consider it a warning.
Force strong, unique, not default, credentials, and where possible, enforce multi-factor authentication (MFA) of the device management interface. Implement role-based access control (RBAC) to manage and control user access, restrict unnecessary permissions, and limit unneeded access, such as remote access or the ability to connect to ports that are not required. IT administrators and disable remote management unless critical.
5. Educate Employees on Internet of Things Risks
The most significant contributor to IoT incidents is human error.
Educate employees on IoT risk awareness that includes phishing attacks or downloading firmware from “unverified” websites. Create a clear, concise, and understandable plan outlining what employees can and cannot do with IoT devices, as well as the procedures to follow when using them. Provide periodic refresh training on good practices.
6. Be Compliant
Any IoT implementation is subject to regulations that you must comply with; failure to do so will result in fines and penalties specific to your industry.
Be aware of what regulators will be looking for. To give an example, the GDPR will focus on data minimization, and HIPAA requires the protection of patient data. Utilize encryption and access controls in your IoT solutions to help ensure compliance with relevant standards. It may be necessary to maintain audit logs of records if they are an explicit requirement for compliance. Encrypt temperature data before transmission to a cloud dashboard.
7. Detect Threats Early
Detecting threats early is very important for IoT security. Use tools like Nagios XI to monitor devices being used and watch for suspicious activity, such as spikes in data usage. Use an Intrusion Detection System (IDS) like Snort to determine compromised devices. Perform compliance investigations to review device configurations and logs occasionally.
Final Thoughts
IoT devices are transforming the way we conduct business, and we must not overlook the cybersecurity risks they pose. There are excellent tools available, such as Nagios XI and AWS IoT Device Defender, that help ensure a healthy IoT ecosystem. If you follow the seven steps above (create an IoT plan, network segmentation, assess vendors and devices, active monitoring, etc.), you can successfully integrate IoT devices safely and build resilience to cyber threats.
