Grooming the Landscape

Tips on managing your cybersecurity

The explosion of IoT devices in today’s technology landscape makes a perfect storm for attackers to exploit. Just to give you a sense of scale, the Department of Defense (DoD) estimates that IT systems in just its environment alone currently present about 10 million potential attack surfaces. When the DoD factors in all their IoT and OT devices, too, that number surges to over 2.6 billion. But it is more than a question of endpoint numbers. It’s a question of complexity.

In recent years, the push for convergence has not only moved security devices like video cameras and access control systems to the network. We’re now seeing systems like HVAC, lighting, signage, and environmental sensors integrated into the landscape. We have wireless and cellular connections, cloud storage, and legacy systems, too, boosting the number of devices on any given network. This raises a growing concern that most of those IoT devices might not support current cybersecurity protocols, or even have been designed with network security in mind. Bear in mind that all these networked IoT devices reside in close interface with your IT systems. So it is imperative that you take steps to ensure these devices don’t become tools or attack vectors that could be used to disrupt or compromise your critical systems.


While a company might standardize on a maximum of three to five operating systems for its IT systems, there are no such common operating systems when it comes to IoT devices. In fact, the DoD estimates that with the billions of IoT devices on the market today, there might be as many as 90,000 different operating systems in play. This makes it particularly difficult to apply the same cybersecurity controls across the entire IoT ecosystem. Without a globally recognized IoT standard for reference, you’ll need to create your own cybersecurity baseline and checklist for your IoT devices. That baseline begins with discovering exactly what is on your network. You may be surprised to find devices you thought were long retired still connected to the network.


Depending on the risk assessment, your IoT cybersecurity plan should reflect the protection necessary for your operating environment. Look at your company’s IT network security policies and see which security control sets you can also implement on your IoT devices. A general rule of thumb is to start with a minimum recommended level of protection and build from there as needed. Standard protection. This includes resetting factory default settings, updating the device with the latest firmware, setting a master password, creating a client account, configuring network settings, setting the date and time, and applying encryption to onboard data storage.

Enterprise protection. This includes all the standard protections plus setting HTTP digest authentication, setting domain and host names, disabling unused features and services, enabling IP address filtering, and enabling HTTPS encryption.

Managed enterprise protection. This includes all standard and enterprise protections plus IEEE 802.1X network access control, SNMP monitoring, and remote system logging.


A vendor’s security posture has a direct impact on the safety of your systems because their systems could become an attack vector into yours. Some good questions to ask the vendors in your supply chain include: Are they developing and manufacturing their own products? Do they retain full control over certifications, firmware and chipsets? Do they test for cyber vulnerabilities at every stage of product development?

If they are an OEM, where are they sourcing their critical components (chipsets, memory, etc.)? Are they contracting their manufacturing from a trusted party? Can they provide you with a bill of materials for their products’ software and firmware? What other manufacturers do their devices rely on in their source code?

Another aspect of vetting your supply chain is determining their policies around timely response to discovered vulnerabilities. How quickly do they publish security patches and bug fixes? How frequently do they issue firmware and software updates? Do they offer automatic update services for their products?

Establishing a Vendor Risk Management Program can help you systematically evaluate potential technology partners and determine whether their demonstrated commitment to cybersecurity meets your high standards.


Vetting your supply chain also helps you to betters understand the interdependencies in your technology ecosystem. Knowing whether a new firmware or software release in one device or system could potentially disrupt integration or an API with another device or system on the network could save you countless headaches. This leads us to another important aspect of IoT cybersecurity: lifecycle management.

A structured lifecycle management program helps you keep track of all the technologies in your ecosystem from the time they’re installed until they reach end of life and are removed from the network. It helps you identify devices nearing their end of life, running outdated operating systems, and more susceptible to risk because they won’t be receiving future updates. This will help you plan when to replace specific devices with newer solutions that the manufacturer currently supports.

The good news is you can automate this ecosystem audit. There are several software tools from product vendors and manufacturing companies that specialize in device management platforms. These platforms not only help you discover every device on your network, they also capture key information about those devices’ identity: • Model number • IP address • MAC address • Currently loaded software, firmware, and operating system • Certificate status

You can use this highly detailed look at your ecosystem to perform a variety of maintenance tasks critical to cybersecurity and lifecycle management best practices: • Managing user privilege levels • Password changes • Firmware updates • Configuration modifications • Certificate management

One of the biggest benefits of using device management software is the ability to push out system changes, firmware updates, and new HTTPS and IEEE 802.1x security certificates to hundreds of devices simultaneously, rather than individually. You can quickly and easily create or reconfigure security settings and apply them to all the appropriate devices on the network. In the case of firmware updates, the device management software automatically verifies that devices are running the latest and most secure version. Knowing the current status of all your devices ensures that you can address new vulnerabilities quickly and limit your exposure.


Given the complexity of today’s ecosystems, implementing an effective IoT cybersecurity plan may seem like a daunting task. But if you break it down into a series of incremental steps, you’ll easily reach your goal.

Discover all your network-connected devices. You can’t protect what you don’t know is there. Develop cybersecurity baseline for all your IoT devices.

Institute password and user management protocols. Always change factory default passwords and setting before allowing devices to go live on the network. Institute password policies that include complex passwords and regularly scheduled password updates. Also, remember to change system management passwords when key administrator personnel leave your company.

Segment your devices and systems. Set up VLANs and firewalls to separate IoT devices from critical systems.

Coordinate cybersecurity efforts with your IT department. Implement those IT cybersecurity protocols that can be supported by IoT devices and make the most sense for how those devices are being used.

Establish ownership of updates and patches. Any systems and devices on the network that have been dormant or not updated could be vectors for attack. Make sure you’re alerted when manufacturer release software and firmware updates, patches, and bug fixes releases. Be sure to verify that administrators implement those releases in a timely manner.

Implement a lifecycle management program. Cybersecurity isn’t a one and done activity. Your IoT device security needs to be kept current to protect against new threats. With lifecycle management you can track the status of each device from time you install it until you retire or replace it. Be sure to review your lifecycle program at least once a year.

With timely oversight and consistent policies and procedures, you be able to anticipate and address a host of cybersecurity and vulnerability issues before they can compromise your network. And that’s what managing IoT cybersecurity is all about.

This article originally appeared in the January / February 2021 issue of Security Today.


  • Maximizing Your Security Budget This Year

    Perimeter Security Standards for Multi-Site Businesses

    When you run or own a business that has multiple locations, it is important to set clear perimeter security standards. By doing this, it allows you to assess and mitigate any potential threats or risks at each site or location efficiently and effectively. Read Now

  • Getting in Someone’s Face

    There was a time, not so long ago, when the tradeshow industry must have thought COVID-19 might wipe out face-to-face meetings. It sure seemed that way about three years ago. Read Now

    • Industry Events
    • ISC West
  • Live From ISC West 2024: Post-Show Recap

    ISC West 2024 is complete. And from start to finish, the entire conference was a huge success with almost 30,000 people in attendance. Read Now

    • Industry Events
    • ISC West
  • ISC West 2024 is a Rousing Success

    The 2024 ISC West security tradeshow marked a pivotal moment in the industry, showcasing cutting-edge technology and innovative solutions to address evolving security challenges. Exhibitors left the event with a profound sense of satisfaction, as they witnessed a high level of engagement from attendees and forged valuable connections with potential clients and partners. Read Now

    • Industry Events
    • ISC West

Featured Cybersecurity


New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3