Grooming the Landscape
Tips on managing your cybersecurity
- By Wayne Dorris
- Feb 01, 2021
The explosion of IoT devices in today’s technology
landscape makes a perfect storm for attackers to
exploit. Just to give you a sense of scale, the Department
of Defense (DoD) estimates that IT systems
in just its environment alone currently present
about 10 million potential attack surfaces. When the DoD factors
in all their IoT and OT devices, too, that number surges to over
2.6 billion. But it is more than a question of endpoint numbers.
It’s a question of complexity.
In recent years, the push for convergence has not only moved
security devices like video cameras and access control systems to
the network. We’re now seeing systems like HVAC, lighting, signage,
and environmental sensors integrated into the landscape.
We have wireless and cellular connections, cloud storage, and
legacy systems, too, boosting the number of devices on any given
network. This raises a growing concern that most of those IoT
devices might not support current cybersecurity protocols, or
even have been designed with network security in mind. Bear in
mind that all these networked IoT devices reside in close interface
with your IT systems. So it is imperative that you take steps to ensure
these devices don’t become tools or attack vectors that could
be used to disrupt or compromise your critical systems.
FACING THE UNIQUE CHALLENGES OF IoT
While a company might standardize on a maximum of three to
five operating systems for its IT systems, there are no such common
operating systems when it comes to IoT devices. In fact, the
DoD estimates that with the billions of IoT devices on the market
today, there might be as many as 90,000 different operating systems
in play. This makes it particularly difficult to apply the same
cybersecurity controls across the entire IoT ecosystem.
Without a globally recognized IoT standard for reference, you’ll
need to create your own cybersecurity baseline and checklist for
your IoT devices. That baseline begins with discovering exactly
what is on your network. You may be surprised to find devices you
thought were long retired still connected to the network.
DIFFERENT LEVELS OF IoT HARDENING
Depending on the risk assessment, your IoT cybersecurity plan
should reflect the protection necessary for your operating environment.
Look at your company’s IT network security policies and see
which security control sets you can also implement on your IoT
devices. A general rule of thumb is to start with a minimum recommended
level of protection and build from there as needed.
Standard protection. This includes resetting factory default
settings, updating the device with the latest firmware, setting a
master password, creating a client account, configuring network
settings, setting the date and time, and applying encryption to
onboard data storage.
Enterprise protection. This includes all the standard protections
plus setting HTTP digest authentication, setting domain
and host names, disabling unused features and services, enabling
IP address filtering, and enabling HTTPS encryption.
Managed enterprise protection. This includes all standard and
enterprise protections plus IEEE 802.1X network access control,
SNMP monitoring, and remote system logging.
VETTING CYBERSECURITY IN THE SUPPLY CHAIN
A vendor’s security posture has a direct impact on the safety of
your systems because their systems could become an attack vector
into yours. Some good questions to ask the vendors in your
supply chain include: Are they developing and manufacturing
their own products? Do they retain full control over certifications,
firmware and chipsets? Do they test for cyber vulnerabilities at
every stage of product development?
If they are an OEM, where are they sourcing their critical components (chipsets, memory, etc.)? Are they contracting their
manufacturing from a trusted party? Can they provide you with a
bill of materials for their products’ software and firmware? What
other manufacturers do their devices rely on in their source code?
Another aspect of vetting your supply chain is determining
their policies around timely response to discovered vulnerabilities.
How quickly do they publish security patches and bug fixes?
How frequently do they issue firmware and software updates? Do
they offer automatic update services for their products?
Establishing a Vendor Risk Management Program can help
you systematically evaluate potential technology partners and
determine whether their demonstrated commitment to cybersecurity
meets your high standards.
EMPLOYING LONG-TERM LIFECYCLE MANAGEMENT
Vetting your supply chain also helps you to betters understand the
interdependencies in your technology ecosystem. Knowing whether a
new firmware or software release in one device or system could potentially
disrupt integration or an API with another device or system on
the network could save you countless headaches. This leads us to another
important aspect of IoT cybersecurity: lifecycle management.
A structured lifecycle management program helps you keep
track of all the technologies in your ecosystem from the time
they’re installed until they reach end of life and are removed from
the network. It helps you identify devices nearing their end of life,
running outdated operating systems, and more susceptible to risk
because they won’t be receiving future updates. This will help you
plan when to replace specific devices with newer solutions that
the manufacturer currently supports.
The good news is you can automate this ecosystem audit.
There are several software tools from product vendors and manufacturing
companies that specialize in device management platforms.
These platforms not only help you discover every device
on your network, they also capture key information about those
devices’ identity:
• Model number
• IP address
• MAC address
• Currently loaded software, firmware, and operating system
• Certificate status
You can use this highly detailed look at your ecosystem to perform
a variety of maintenance tasks critical to cybersecurity and
lifecycle management best practices:
• Managing user privilege levels
• Password changes
• Firmware updates
• Configuration modifications
• Certificate management
One of the biggest benefits of using device management software
is the ability to push out system changes, firmware updates,
and new HTTPS and IEEE 802.1x security certificates to hundreds
of devices simultaneously, rather than individually. You can
quickly and easily create or reconfigure security settings and apply
them to all the appropriate devices on the network. In the case of
firmware updates, the device management software automatically
verifies that devices are running the latest and most secure version.
Knowing the current status of all your devices ensures that you can
address new vulnerabilities quickly and limit your exposure.
IT’S DAUNTING BUT DOABLE, ONE STEP AT A TIME
Given the complexity of today’s ecosystems, implementing an effective
IoT cybersecurity plan may seem like a daunting task. But
if you break it down into a series of incremental steps, you’ll easily
reach your goal.
Discover all your network-connected devices. You can’t protect
what you don’t know is there. Develop cybersecurity baseline for
all your IoT devices.
Institute password and user management protocols. Always
change factory default passwords and setting before allowing devices
to go live on the network. Institute password policies that
include complex passwords and regularly scheduled password updates.
Also, remember to change system management passwords
when key administrator personnel leave your company.
Segment your devices and systems. Set up VLANs and firewalls
to separate IoT devices from critical systems.
Coordinate cybersecurity efforts with your IT department. Implement
those IT cybersecurity protocols that can be supported
by IoT devices and make the most sense for how those devices
are being used.
Establish ownership of updates and patches. Any systems and
devices on the network that have been dormant or not updated
could be vectors for attack. Make sure you’re alerted when manufacturer
release software and firmware updates, patches, and bug
fixes releases. Be sure to verify that administrators implement
those releases in a timely manner.
Implement a lifecycle management program. Cybersecurity
isn’t a one and done activity. Your IoT device security needs to be
kept current to protect against new threats. With lifecycle management
you can track the status of each device from time you
install it until you retire or replace it. Be sure to review your lifecycle
program at least once a year.
With timely oversight and consistent policies and procedures,
you be able to anticipate and address a host of cybersecurity and
vulnerability issues before they can compromise
your network. And that’s what managing IoT
cybersecurity is all about.
This article originally appeared in the January / February 2021 issue of Security Today.