It was just over a year ago when the Mirai botnet made its dramatic debut on the world stage. After initially flooding a security journalist’s website with traffic, it went on to grind the internet to a halt for millions of users. The botnet did this by overwhelming Dyn, a company that controls much of the internet’s domain name system infrastructure. Since then, variations of the malicious source code have been used in a number of high-profile attacks on internet infrastructure.
Mirai and its offspring are self-propagating botnets that target and infect poorly protected IoT devices by exploiting people that repeatedly use default usernames and passwords. Once hijacked, these devices have been used to mount some of the biggest distributed denial-of-service attacks we’ve ever seen.
In some ways, enterprise IoT security is being managed a bit like IT security was way back in the ’90s — as an afterthought. This has to stop. After all, we forecast that there will be 20 billion connected IoT devices by 2023. Clearly, there are new and different security requirements than there were in the past.
IoT devices are being targeted for many reasons. Often, poor understanding of enterprise IoT security leads to weak protection for many IoT devices, which makes them easy targets for hackers.
Many IoT devices still don’t have advanced security features. This is especially true of simpler devices, such as a temperature sensors, which have limited processing power and basic operating systems. As they are designed to be plugged in and forgotten about, owners tend not to do security updates frequently, if ever, making it quite easy for an attack on such devices to go unnoticed.
In a connected world, these simple devices can be connected to more critical systems further up in the network. If even a small, simple device malfunctions or is tampered with, it can lead to serious security issues.
The Mirai botnet was an eye opener, not least because it neatly illustrates that the IoT industry is facing ominous threats and that we need to prioritize securing the IoT ecosystem. But what can be done to help secure the IoT?
In my opinion, the prevalence of insecure IoT devices makes it likely that, for the foreseeable future, they may be one of the main entry points for future attacks on mission-critical systems. The silver lining is that IoT botnets can be averted if IoT vendors follow basic security best practices.
In fact, all participants in the IoT ecosystem need to have security as a top priority, from device manufacturers, through networks to platforms and applications. Which means security is no longer a “nice to have” add-on feature. It is a necessity.
Thankfully, enterprise IoT security is steadily becoming an issue of high concern. Measures are being taken by many IoT vendors to prevent security breaches at the device level, and efforts are being made to tackle major disasters before hacks occur.
It’s still not enough.
When you’re going up against expert hackers, you can’t partner with amateurs or you risk paying the price. To ensure their customers’ telco infrastructure is secure from complex attacks, IoT vendors must work with competent partners whom they can trust.
All IoT Agenda network contributors are responsible for the content and accuracy of their posts. Opinions are of the writers and do not necessarily convey the thoughts of IoT Agenda.