INDUSTRY PROFESSIONAL

Once and For All

Anyone who knows Disney at all probably remembers the movie “Fantasia,” and relating to Mickey Mouse in “The Sorcerer’s Apprentice,” as he cast a spell on a broom to do his chores for him and make his life a little easier. SPOILER ALERT: it did not go as Mickey intended, with the broom ultimately cloning itself ad infinitum and causing a massive flood that almost drowned Mickey.

The Internet of Things (IoT) offers parallel benefits, but also a parallel lesson. On the one hand, IoT makes our everyday lives easier. Smart speakers make it easy to play different types of music in different rooms, and people feel safer when their home is watched 24/7 by a smart security system. However, IoT represents a substantial risk for the networks to which they are connected.

IT IS ABOUT THE SOFTWARE

IoT software — all software — is written by humans, which means it will never be perfectly secure code, even if it’s created under the most idyllic secure software development lifecycle implementation. Unfortunately, IoT software (especially consumer IoT) tends to be less secure, which means easy-toexploit vulnerabilities and more of them.

Consumer IoT software is an interesting problem because it’s not as though manufacturers are intentionally releasing smart thermostats, remote control drones or connected coffee makers that will “go rogue” and start sending sensitive data to attackers. Secure coding practices are more expensive and security is not accountable. The fact is that currently, secure code is not part of consumer IoT buying criteria.

SECURING IOT: WHAT DOESN’T WORK

For devices where the code may not be the most secure, endpoint agents that detect and stop exploits and malware deployed on the device itself, to help keep it safe. The agents are not deployed on IoT devices for a few reasons: • Endpoint agents are too expensive, financially and operationally, for consumers to purchase, and install, and manage themselves. • Endpoint agents are for specific operating systems and IoT devices use such a wide variety of operating systems that it is not feasible that an agent will specifically apply to each one.

Some IoT manufacturers will issue software patches to fix vulnerabilities and bugs, but deploying and applying patches comes with some operational overhead. For example, for someone to upgrade their phone OS they likely have to start the install manually and then restart their phone. It is annoying, so most consumers will put off software upgrades until forced to apply them.

For Industrial IoT (IIoT), patching and endpoint agents are a no-go. These systems are critical for infrastructure to function — think gas pipelines, power grids or water mains — so taking them offline to apply patches is out of the question.

Therefore, the network has the job of providing security measures for connected IoT devices.

SECURING IOT: GETTING STARTED

The first step is identifying that a connected device is indeed an IoT device and then understanding the risk that device presents to the network. For example: • What is the use of the device? • What access does it currently have? • Is it running current software? • Does that software have known high-severity vulnerabilities? • Is that device exhibiting compromised behavior?

Answering these questions about an IoT device is fundamental to figuring out how best to secure it. There are many mechanisms that a threat-aware network can employ based on the context of these answers.

IoT devices can also be put into a separate security zone with access to resources limited based only on what the device needs to access (least privilege), and that access should be segmented based on individual sessions. For example, a printer on the Fourth floor of a building can only have access to files sent to it for printing and is not able to communicate with the engineering department’s internal code repository. Access can and be defined per session, and the direction of each session should be enforced. If a new, unknown IoT device tries to connect via Wi-Fi or Bluetooth, perhaps it connects to the guest network until questions are answered sufficiently.

Additional security measures can be applied to IoT devices; such as always-on decryption with IPS/anti-malware, content inspection and sandboxing for all unknown files. Network behavior to and from IoT devices monitored for indicators of compromise, such as beaconing behaviors and connections to known command-and-control domains and IP addresses.

HOW THE NETWORK CAN HELP

That said, when an IoT device is compromised and endpoint protection is not there or a patch cannot be deployed quickly, what can be done? The network can offer some mitigation.

In a threat-aware network, the infrastructure itself can stop certain connections. A Wi-Fi access point might be able to help assess the risk of the connecting device. The router might be able to prevent a compromised device being leveraged in a DDoS attack or prevent command-and-control communication to and from malicious domains and IP addresses. The switch might be able to help quarantine an infected IoT device at the switch port. All of this is beyond what a firewall can and should do.

In a threat-aware network, every point of connection participates in visibility, threat intelligence and enforcement, and IoT threats are thwarted at every stop. It is not just Mickey Mouse wringing his hands while the water level keeps rising; the threat-aware network helps solve for some of the security issues inherent in IoT so the benefits can be realized and life can be a little easier.

This article originally appeared in the September / October 2021 issue of Security Today.

Featured

  • Freedom of Choice

    In today's security landscape, we are witnessing a fundamental transformation in how organizations manage digital evidence. Law enforcement agencies, campus security teams, and large facility operators face increasingly complex challenges with expanding video data, tightening budget constraints and inflexible systems that limit innovation. Read Now

  • Accelerating a Pathway

    There is a new trend touting the transformational qualities of AI’s ability to deliver actionable data and predictive analysis that in many instances, seems to be a bit of an overpromise. The reality is that very few solutions in the cyber-physical security (CPS) space live up to this high expectation with the one exception being the new generation of Physical Identity and Access Management (PIAM) software – herein recategorized as PIAM+. Read Now

  • Protecting Your Zones

    It is game day. You can feel the crowd’s energy. In the parking lot. At the gate. In the stadium. On the concourse. Fans are eager to party. Food and merchandise vendors ready themselves for the rush. Read Now

  • Street Smarts

    The ongoing acceptance of AI and advanced data analytics has allowed surveillance camera technology to shift from being a tactical tool to a strategic business solution. Combining traditional surveillance technology with AI-based data-driven insights can streamline transportation systems, enhance traffic management, improve situational awareness, optimize resource allocation and streamline emergency response procedures. Read Now

  • Midtown Manhattan Shooting Kills 4, Including NYPD Officer

    Four people were killed, including a NYPD officer, in a midtown Manhattan shooting on Monday. That’s according to CNN. Read Now

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.