Grooming the Landscape

Tips on managing your cybersecurity

The explosion of IoT devices in today’s technology landscape makes a perfect storm for attackers to exploit. Just to give you a sense of scale, the Department of Defense (DoD) estimates that IT systems in just its environment alone currently present about 10 million potential attack surfaces. When the DoD factors in all their IoT and OT devices, too, that number surges to over 2.6 billion. But it is more than a question of endpoint numbers. It’s a question of complexity.

In recent years, the push for convergence has not only moved security devices like video cameras and access control systems to the network. We’re now seeing systems like HVAC, lighting, signage, and environmental sensors integrated into the landscape. We have wireless and cellular connections, cloud storage, and legacy systems, too, boosting the number of devices on any given network. This raises a growing concern that most of those IoT devices might not support current cybersecurity protocols, or even have been designed with network security in mind. Bear in mind that all these networked IoT devices reside in close interface with your IT systems. So it is imperative that you take steps to ensure these devices don’t become tools or attack vectors that could be used to disrupt or compromise your critical systems.


While a company might standardize on a maximum of three to five operating systems for its IT systems, there are no such common operating systems when it comes to IoT devices. In fact, the DoD estimates that with the billions of IoT devices on the market today, there might be as many as 90,000 different operating systems in play. This makes it particularly difficult to apply the same cybersecurity controls across the entire IoT ecosystem. Without a globally recognized IoT standard for reference, you’ll need to create your own cybersecurity baseline and checklist for your IoT devices. That baseline begins with discovering exactly what is on your network. You may be surprised to find devices you thought were long retired still connected to the network.


Depending on the risk assessment, your IoT cybersecurity plan should reflect the protection necessary for your operating environment. Look at your company’s IT network security policies and see which security control sets you can also implement on your IoT devices. A general rule of thumb is to start with a minimum recommended level of protection and build from there as needed. Standard protection. This includes resetting factory default settings, updating the device with the latest firmware, setting a master password, creating a client account, configuring network settings, setting the date and time, and applying encryption to onboard data storage.

Enterprise protection. This includes all the standard protections plus setting HTTP digest authentication, setting domain and host names, disabling unused features and services, enabling IP address filtering, and enabling HTTPS encryption.

Managed enterprise protection. This includes all standard and enterprise protections plus IEEE 802.1X network access control, SNMP monitoring, and remote system logging.


A vendor’s security posture has a direct impact on the safety of your systems because their systems could become an attack vector into yours. Some good questions to ask the vendors in your supply chain include: Are they developing and manufacturing their own products? Do they retain full control over certifications, firmware and chipsets? Do they test for cyber vulnerabilities at every stage of product development?

If they are an OEM, where are they sourcing their critical components (chipsets, memory, etc.)? Are they contracting their manufacturing from a trusted party? Can they provide you with a bill of materials for their products’ software and firmware? What other manufacturers do their devices rely on in their source code?

Another aspect of vetting your supply chain is determining their policies around timely response to discovered vulnerabilities. How quickly do they publish security patches and bug fixes? How frequently do they issue firmware and software updates? Do they offer automatic update services for their products?

Establishing a Vendor Risk Management Program can help you systematically evaluate potential technology partners and determine whether their demonstrated commitment to cybersecurity meets your high standards.


Vetting your supply chain also helps you to betters understand the interdependencies in your technology ecosystem. Knowing whether a new firmware or software release in one device or system could potentially disrupt integration or an API with another device or system on the network could save you countless headaches. This leads us to another important aspect of IoT cybersecurity: lifecycle management.

A structured lifecycle management program helps you keep track of all the technologies in your ecosystem from the time they’re installed until they reach end of life and are removed from the network. It helps you identify devices nearing their end of life, running outdated operating systems, and more susceptible to risk because they won’t be receiving future updates. This will help you plan when to replace specific devices with newer solutions that the manufacturer currently supports.

The good news is you can automate this ecosystem audit. There are several software tools from product vendors and manufacturing companies that specialize in device management platforms. These platforms not only help you discover every device on your network, they also capture key information about those devices’ identity: • Model number • IP address • MAC address • Currently loaded software, firmware, and operating system • Certificate status

You can use this highly detailed look at your ecosystem to perform a variety of maintenance tasks critical to cybersecurity and lifecycle management best practices: • Managing user privilege levels • Password changes • Firmware updates • Configuration modifications • Certificate management

One of the biggest benefits of using device management software is the ability to push out system changes, firmware updates, and new HTTPS and IEEE 802.1x security certificates to hundreds of devices simultaneously, rather than individually. You can quickly and easily create or reconfigure security settings and apply them to all the appropriate devices on the network. In the case of firmware updates, the device management software automatically verifies that devices are running the latest and most secure version. Knowing the current status of all your devices ensures that you can address new vulnerabilities quickly and limit your exposure.


Given the complexity of today’s ecosystems, implementing an effective IoT cybersecurity plan may seem like a daunting task. But if you break it down into a series of incremental steps, you’ll easily reach your goal.

Discover all your network-connected devices. You can’t protect what you don’t know is there. Develop cybersecurity baseline for all your IoT devices.

Institute password and user management protocols. Always change factory default passwords and setting before allowing devices to go live on the network. Institute password policies that include complex passwords and regularly scheduled password updates. Also, remember to change system management passwords when key administrator personnel leave your company.

Segment your devices and systems. Set up VLANs and firewalls to separate IoT devices from critical systems.

Coordinate cybersecurity efforts with your IT department. Implement those IT cybersecurity protocols that can be supported by IoT devices and make the most sense for how those devices are being used.

Establish ownership of updates and patches. Any systems and devices on the network that have been dormant or not updated could be vectors for attack. Make sure you’re alerted when manufacturer release software and firmware updates, patches, and bug fixes releases. Be sure to verify that administrators implement those releases in a timely manner.

Implement a lifecycle management program. Cybersecurity isn’t a one and done activity. Your IoT device security needs to be kept current to protect against new threats. With lifecycle management you can track the status of each device from time you install it until you retire or replace it. Be sure to review your lifecycle program at least once a year.

With timely oversight and consistent policies and procedures, you be able to anticipate and address a host of cybersecurity and vulnerability issues before they can compromise your network. And that’s what managing IoT cybersecurity is all about.

This article originally appeared in the January / February 2021 issue of Security Today.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3