Security What to Do About the Internet of Things
A defense against all of these horrors begins with keeping out those with malicious intentions. Put two-factor authentication at an organization's perimeter -- including it in onboarding -- to block the threat actors from entering the target's business in the first place. Now's a good time to start blocking suspicious sign-ups from coming into your business' website or network -- IoT is already gaining ground. Gartner Group estimates that more than half of major new business systems and processes will have an IoT component by 2020. And Gartner says there will be almost 20 billion of the devices in circulation by 2020, generating more than $300 billion in apps and service-related revenues. Total spending on endpoints and services for IoT may reach nearly $2 trillion by the end of 2017, with 8.4 billion of these gizmos connected to the Internet worldwide, according to Gartner.
All Preventable
A recent study of IoT vulnerabilities reported between November 2015 and September 2016 found that 100% of them were completely avoidable -- all preventable if the device manufacturers and developers had implemented security and privacy principles outlined in the Online Trust Alliance's IoT Trust Framework. The organization's framework notes the following eight items as the most glaring points of vulnerability:- Insecure credential anagement including making administrative controls open and discoverable
- Not adequately and accurately disclosing consumer data collection and sharing policies and practices
- The omission or lack of rigorous security testing throughout the development process including but not limited to penetration testing and threat modeling
- The lack of a discoverable process or capability to responsibly report observed vulnerabilities
- Insecure or no network pairing control options (device to device or device to networks)
- Not testing for common code injection exploits
- The lack of transport security and encrypted storage including unencrypted data transmission of personal and sensitive information including but not limited to user ID and passwords
- Lacking a sustainable and supportable plan to address vulnerabilities through the product lifecycle
