With the IoT market increasing in size and more things become connected to the Internet, it is very important to look IoT security. They would also be attacked very differently than a server locked in a room protected by a Firewall. As we dive into this article, it is important to remember that security is ever-evolving. We must always remember that attackers will always keep trying to break down security protocols that you might put in place, especially when it comes to IoT security.
Covered in this article:
Preventing Physical Access Attacks when it comes to IoT Security
The most obvious threats to IoT devices are physical threats. The most basic application of this is someone coming into your home, taking your device and replacing it with one they can control. Unless you can control the location of the device and who can access it, this is very easy to accomplish. This can become increasingly dangerous in the business environment with IoT devices.
Network Connectivity
Most IoT devices use consumer-grade Wi-Fi networks. These are fast, cheap and work most of the time. However, fast and cheap sometimes means vulnerable to hackers. To crack a simple 8 digit WPA2 secured password can take as little as 2.4 seconds. Once you’ve hacked the network you can pretty much get onto any device connected to that network.
Securing your Network for IoT
An IoT device is essentially a computer connected to the internet. Whilst they are different from your standard laptop/PC, everything you do to protect your PC, you should do to your IoT devices. you need to ensure only properly secured server processes are open to the internet so they won’t be used to break into the device, encrypt anything you transfer, and force users to change the default credential on the administrative account.
Open Ports
Sometimes, open network ports are necessary. If a device uses a web-based interface, it needs an open port for the HTTP server. However, every connection through the network is a security risk. You can access a list of known vulnerabilities here. The problem is that CVE only lists known vulnerabilities, there are probably thousands of unknown ones out there. The easiest way to block network access is by using a firewall. A cloud or actual firewall device would work here.
IoT Security: Encryption
In network security, 2 possible attacks occur on data that travels through the Internet. Whether it’s the IoT devices communicating to a server or the server communication to the device.
- Theft – your IoT data might be valuable to other people. For example, knowing that your lights haven’t been switched on for a week might mean that you’re not home and the contents of your home are easily accessible to thieves.
- Modification – If your house as an alarm controlled by an IoT device, it would make a burglar quite happy to hack into this system and disarm your home.
Keeping your default credentials
IoT devices are typically administered remotely. Usually, once administered you receive a default username and password, which you are supposed to change. If these aren’t changed, hackers can use them to control your device. This attack has already happened to IoT devices – the Mirari, BrikerBot, and Amnesia malware programs have used default credentials to break into IoT devices.
Perfect security won’t happen anytime soon (unless blockchain finds a way) but you can do what you can to make your IoT devices more difficult to hack than others.
