The Internet of Things and the security challenges it creates for small business

Managing the traditional limitations of time and resources means that running a small business on a budget is a challenge, but these difficulties become more pronounced when resources are stretched even further by the increased security demands of new technology.

• By Terry Hearn
• Jun 14, 2019

In recent years, high-profile data breaches have regularly hit the headlines and cybersecurity has become an increased concern for companies of all sizes. While they rarely make the news, small businesses are thought to be targeted in 43% of cyberattacks, making the need for improved security best practices a priority.

Managing the traditional limitations of time and resources means that running a small business on a budget is a challenge, but these difficulties become more pronounced when resources are stretched even further by the increased security demands of new technology. An increasing area of threat is the use of Internet of Things (IoT) devices on company networks. IoT devices certainly offer many benefits and can help to improve efficiency, but having to manage a rapid increase in endpoints on your network also poses a significant security risk.

Why is IoT such a security risk?

When trying to access a company network, hackers will look to identify weak points in the security. The front door might be metaphorically bolted with antivirus software, but if someone has left a window open so to speak, breaking in can be deceptively simple. With IoT, even the most innocuous devices can now pose a threat. It could be printers, lightbulbs, toasters or speakers - every improperly configured device that connects to your network is a potential entry point.

By 2022 Juniper estimates there will be 50 billion active IoT devices and that means plenty of additional points of entry that need to be monitored. Between managing this influx of devices and the increasing number of personal devices used for remote working, SMBs are facing the challenge of keeping pace with technological advances to ensure that they do not become an Achilles heel.

How to minimize the risk

As technology evolves, so will the type of security solutions required. The type and scale of threats is also likely to vary between companies in different industries, but the basic principles of security best practices for IoT will remain the same.

In the UK there has been an attempt by the government to improve the security on IoT devices with a labelling scheme and Code of Practice that hopes to ensure that devices are only sold if they feature a certain level of security. While this scheme may help to improve security best practices at the manufacturing level, small business owners must ensure the introduction and implementation of these devices is done correctly today, rather than waiting for the government to catch up.

Patches and updates

Security updates are often created as a response to a known vulnerability, and so it is essential that they are applied as soon as possible to ensure that your devices are protected against that threat.

While device patches and updates are usually released on a regular basis, many people forget the importance of applying them as soon as they become available. Updates might appear while a device is in use, resulting in users deciding to delay the installation for the sake of convenience. But coming back later can easily be forgotten, and in the meantime, devices will remain unprotected.

With so many devices in an office, ensuring every single one is updated could quickly become an arduous task, especially if the IT department consists of one person, or is a role that is split between people.

To ensure that all devices are protected and updated, patching has to become a shared responsibility, with staff trained to manage their own devices, leaving the IT team to focus elsewhere. This also has the added benefit of making security a daily consideration for staff, keeping it at the front of their mind rather than something that is only considered when prompted to change their passwords.

Strong passwords

One of the main selling points of IoT devices is their convenience. However, while it is easy to connect them to your network, many people do not think to change the default passwords. Simply by identifying your device, hackers will be in a position to quickly identify the default password too.

Despite regular warnings, the most commonly repeated security measure is still one that is regularly ignored. The 2019 Avast Smart Home Report found that 40% of smart homes have at least one vulnerable device, and 69.2% of these have weak security credentials.

As these devices become commonplace in offices around the world, it is crucial that easily protected security weak points are correctly managed so that bad domestic habits do not become an issue for your business. Strong passwords are not just for laptops, but any device that connects to your network, whatever its purpose.

Device security

Security does not end at strong passwords. To protect against IoT threats, endpoint security tools are essential to operate alongside antivirus, firewalls and malware scanners. While these traditional methods will perform scans and remove malicious threats, additional tools can be used to protect data from ransomware attacks, identify vulnerabilities in the WiFi and flag potential phishing emails.

Where companies have both IoT and large numbers of personal devices, SMBs should consider implementing a bring your own device (BYOD) policy to ensure that any personal devices accessing the network, in the office or remotely, are all secured with strong passwords, security software and two factor authentication.

Education

While the idea of a malicious group of hackers may spring to mind when talking about cyber security, the reality is very different. 2018 research in the UK found that 88% of breaches were caused by human error.

Effective antivirus and strong passwords are crucial aspects of IoT security, but when your staff are the biggest risk when it comes to a data breach, effective training is crucial. It shouldn’t be a dry lecture and should be made as open and engaging as possible.

By providing regular updates about new threats, providing software training and ensuring that everyone, regardless of IT ability or position in the company, is confident when it comes to their responsibilities, your company will gradually build a culture of security. This will make it a constant consideration and will help to minimize careless errors that could have devastating consequences.

A Ponemon Institute report found that IoT-related breaches reached 26% in 2018, increasing from 15% just a year before. For small businesses to effectively manage evolving data security, it is vital that it is given the same level of consideration as physical security. This does not mean installing an expensive security system, but does require care and awareness from everyone involved to ensure that easily avoidable mistakes do not undermine your security.