Grooming the Landscape

Tips on managing your cybersecurity

• By Wayne Dorris
• Feb 01, 2021

The explosion of IoT devices in today’s technology landscape makes a perfect storm for attackers to exploit. Just to give you a sense of scale, the Department of Defense (DoD) estimates that IT systems in just its environment alone currently present about 10 million potential attack surfaces. When the DoD factors in all their IoT and OT devices, too, that number surges to over 2.6 billion. But it is more than a question of endpoint numbers. It’s a question of complexity.

In recent years, the push for convergence has not only moved security devices like video cameras and access control systems to the network. We’re now seeing systems like HVAC, lighting, signage, and environmental sensors integrated into the landscape. We have wireless and cellular connections, cloud storage, and legacy systems, too, boosting the number of devices on any given network. This raises a growing concern that most of those IoT devices might not support current cybersecurity protocols, or even have been designed with network security in mind. Bear in mind that all these networked IoT devices reside in close interface with your IT systems. So it is imperative that you take steps to ensure these devices don’t become tools or attack vectors that could be used to disrupt or compromise your critical systems.

FACING THE UNIQUE CHALLENGES OF IoT

While a company might standardize on a maximum of three to five operating systems for its IT systems, there are no such common operating systems when it comes to IoT devices. In fact, the DoD estimates that with the billions of IoT devices on the market today, there might be as many as 90,000 different operating systems in play. This makes it particularly difficult to apply the same cybersecurity controls across the entire IoT ecosystem. Without a globally recognized IoT standard for reference, you’ll need to create your own cybersecurity baseline and checklist for your IoT devices. That baseline begins with discovering exactly what is on your network. You may be surprised to find devices you thought were long retired still connected to the network.

DIFFERENT LEVELS OF IoT HARDENING

Depending on the risk assessment, your IoT cybersecurity plan should reflect the protection necessary for your operating environment. Look at your company’s IT network security policies and see which security control sets you can also implement on your IoT devices. A general rule of thumb is to start with a minimum recommended level of protection and build from there as needed. Standard protection. This includes resetting factory default settings, updating the device with the latest firmware, setting a master password, creating a client account, configuring network settings, setting the date and time, and applying encryption to onboard data storage.

Enterprise protection. This includes all the standard protections plus setting HTTP digest authentication, setting domain and host names, disabling unused features and services, enabling IP address filtering, and enabling HTTPS encryption.

Managed enterprise protection. This includes all standard and enterprise protections plus IEEE 802.1X network access control, SNMP monitoring, and remote system logging.

VETTING CYBERSECURITY IN THE SUPPLY CHAIN

A vendor’s security posture has a direct impact on the safety of your systems because their systems could become an attack vector into yours. Some good questions to ask the vendors in your supply chain include: Are they developing and manufacturing their own products? Do they retain full control over certifications, firmware and chipsets? Do they test for cyber vulnerabilities at every stage of product development?

If they are an OEM, where are they sourcing their critical components (chipsets, memory, etc.)? Are they contracting their manufacturing from a trusted party? Can they provide you with a bill of materials for their products’ software and firmware? What other manufacturers do their devices rely on in their source code?

Another aspect of vetting your supply chain is determining their policies around timely response to discovered vulnerabilities. How quickly do they publish security patches and bug fixes? How frequently do they issue firmware and software updates? Do they offer automatic update services for their products?

Establishing a Vendor Risk Management Program can help you systematically evaluate potential technology partners and determine whether their demonstrated commitment to cybersecurity meets your high standards.

EMPLOYING LONG-TERM LIFECYCLE MANAGEMENT

Vetting your supply chain also helps you to betters understand the interdependencies in your technology ecosystem. Knowing whether a new firmware or software release in one device or system could potentially disrupt integration or an API with another device or system on the network could save you countless headaches. This leads us to another important aspect of IoT cybersecurity: lifecycle management.

A structured lifecycle management program helps you keep track of all the technologies in your ecosystem from the time they’re installed until they reach end of life and are removed from the network. It helps you identify devices nearing their end of life, running outdated operating systems, and more susceptible to risk because they won’t be receiving future updates. This will help you plan when to replace specific devices with newer solutions that the manufacturer currently supports.

The good news is you can automate this ecosystem audit. There are several software tools from product vendors and manufacturing companies that specialize in device management platforms. These platforms not only help you discover every device on your network, they also capture key information about those devices’ identity: • Model number • IP address • MAC address • Currently loaded software, firmware, and operating system • Certificate status

You can use this highly detailed look at your ecosystem to perform a variety of maintenance tasks critical to cybersecurity and lifecycle management best practices: • Managing user privilege levels • Password changes • Firmware updates • Configuration modifications • Certificate management

One of the biggest benefits of using device management software is the ability to push out system changes, firmware updates, and new HTTPS and IEEE 802.1x security certificates to hundreds of devices simultaneously, rather than individually. You can quickly and easily create or reconfigure security settings and apply them to all the appropriate devices on the network. In the case of firmware updates, the device management software automatically verifies that devices are running the latest and most secure version. Knowing the current status of all your devices ensures that you can address new vulnerabilities quickly and limit your exposure.

IT’S DAUNTING BUT DOABLE, ONE STEP AT A TIME

Given the complexity of today’s ecosystems, implementing an effective IoT cybersecurity plan may seem like a daunting task. But if you break it down into a series of incremental steps, you’ll easily reach your goal.

Discover all your network-connected devices. You can’t protect what you don’t know is there. Develop cybersecurity baseline for all your IoT devices.

Institute password and user management protocols. Always change factory default passwords and setting before allowing devices to go live on the network. Institute password policies that include complex passwords and regularly scheduled password updates. Also, remember to change system management passwords when key administrator personnel leave your company.

Segment your devices and systems. Set up VLANs and firewalls to separate IoT devices from critical systems.

Coordinate cybersecurity efforts with your IT department. Implement those IT cybersecurity protocols that can be supported by IoT devices and make the most sense for how those devices are being used.

Establish ownership of updates and patches. Any systems and devices on the network that have been dormant or not updated could be vectors for attack. Make sure you’re alerted when manufacturer release software and firmware updates, patches, and bug fixes releases. Be sure to verify that administrators implement those releases in a timely manner.

Implement a lifecycle management program. Cybersecurity isn’t a one and done activity. Your IoT device security needs to be kept current to protect against new threats. With lifecycle management you can track the status of each device from time you install it until you retire or replace it. Be sure to review your lifecycle program at least once a year.

With timely oversight and consistent policies and procedures, you be able to anticipate and address a host of cybersecurity and vulnerability issues before they can compromise your network. And that’s what managing IoT cybersecurity is all about.

This article originally appeared in the January / February 2021 issue of Security Today.