Once and For All

Anyone who knows Disney at all probably remembers the movie “Fantasia,” and relating to Mickey Mouse in “The Sorcerer’s Apprentice,” as he cast a spell on a broom to do his chores for him and make his life a little easier. SPOILER ALERT: it did not go as Mickey intended, with the broom ultimately cloning itself ad infinitum and causing a massive flood that almost drowned Mickey.

The Internet of Things (IoT) offers parallel benefits, but also a parallel lesson. On the one hand, IoT makes our everyday lives easier. Smart speakers make it easy to play different types of music in different rooms, and people feel safer when their home is watched 24/7 by a smart security system. However, IoT represents a substantial risk for the networks to which they are connected.


IoT software — all software — is written by humans, which means it will never be perfectly secure code, even if it’s created under the most idyllic secure software development lifecycle implementation. Unfortunately, IoT software (especially consumer IoT) tends to be less secure, which means easy-toexploit vulnerabilities and more of them.

Consumer IoT software is an interesting problem because it’s not as though manufacturers are intentionally releasing smart thermostats, remote control drones or connected coffee makers that will “go rogue” and start sending sensitive data to attackers. Secure coding practices are more expensive and security is not accountable. The fact is that currently, secure code is not part of consumer IoT buying criteria.


For devices where the code may not be the most secure, endpoint agents that detect and stop exploits and malware deployed on the device itself, to help keep it safe. The agents are not deployed on IoT devices for a few reasons: • Endpoint agents are too expensive, financially and operationally, for consumers to purchase, and install, and manage themselves. • Endpoint agents are for specific operating systems and IoT devices use such a wide variety of operating systems that it is not feasible that an agent will specifically apply to each one.

Some IoT manufacturers will issue software patches to fix vulnerabilities and bugs, but deploying and applying patches comes with some operational overhead. For example, for someone to upgrade their phone OS they likely have to start the install manually and then restart their phone. It is annoying, so most consumers will put off software upgrades until forced to apply them.

For Industrial IoT (IIoT), patching and endpoint agents are a no-go. These systems are critical for infrastructure to function — think gas pipelines, power grids or water mains — so taking them offline to apply patches is out of the question.

Therefore, the network has the job of providing security measures for connected IoT devices.


The first step is identifying that a connected device is indeed an IoT device and then understanding the risk that device presents to the network. For example: • What is the use of the device? • What access does it currently have? • Is it running current software? • Does that software have known high-severity vulnerabilities? • Is that device exhibiting compromised behavior?

Answering these questions about an IoT device is fundamental to figuring out how best to secure it. There are many mechanisms that a threat-aware network can employ based on the context of these answers.

IoT devices can also be put into a separate security zone with access to resources limited based only on what the device needs to access (least privilege), and that access should be segmented based on individual sessions. For example, a printer on the Fourth floor of a building can only have access to files sent to it for printing and is not able to communicate with the engineering department’s internal code repository. Access can and be defined per session, and the direction of each session should be enforced. If a new, unknown IoT device tries to connect via Wi-Fi or Bluetooth, perhaps it connects to the guest network until questions are answered sufficiently.

Additional security measures can be applied to IoT devices; such as always-on decryption with IPS/anti-malware, content inspection and sandboxing for all unknown files. Network behavior to and from IoT devices monitored for indicators of compromise, such as beaconing behaviors and connections to known command-and-control domains and IP addresses.


That said, when an IoT device is compromised and endpoint protection is not there or a patch cannot be deployed quickly, what can be done? The network can offer some mitigation.

In a threat-aware network, the infrastructure itself can stop certain connections. A Wi-Fi access point might be able to help assess the risk of the connecting device. The router might be able to prevent a compromised device being leveraged in a DDoS attack or prevent command-and-control communication to and from malicious domains and IP addresses. The switch might be able to help quarantine an infected IoT device at the switch port. All of this is beyond what a firewall can and should do.

In a threat-aware network, every point of connection participates in visibility, threat intelligence and enforcement, and IoT threats are thwarted at every stop. It is not just Mickey Mouse wringing his hands while the water level keeps rising; the threat-aware network helps solve for some of the security issues inherent in IoT so the benefits can be realized and life can be a little easier.

This article originally appeared in the September / October 2021 issue of Security Today.


  • Survey: Less Than Half of IT Leaders are Confident in their IoT Security Plans

    Viakoo recently released findings from its 2024 IoT Security Crisis: By the Numbers. The survey uncovers insights from IT and security executives, exposes a dramatic surge in enterprise IoT security risks, and highlights a critical missing piece in the IoT security technology stack. The clarion call is clear: IT leaders urgently need to secure their IoT infrastructure one application at a time in an automated and expeditious fashion. Read Now

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

Featured Cybersecurity


New Products

  • ComNet CNGE6FX2TX4PoE

    The ComNet cost-efficient CNGE6FX2TX4PoE is a six-port switch that offers four Gbps TX ports that support the IEEE802.3at standard and provide up to 30 watts of PoE to PDs. It also has a dedicated FX/TX combination port as well as a single FX SFP to act as an additional port or an uplink port, giving the user additional options in managing network traffic. The CNGE6FX2TX4PoE is designed for use in unconditioned environments and typically used in perimeter surveillance. 3

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame. 3

  • Hanwha QNO-7012R

    Hanwha QNO-7012R

    The Q Series cameras are equipped with an Open Platform chipset for easy and seamless integration with third-party systems and solutions, and analog video output (CVBS) support for easy camera positioning during installation. A suite of on-board intelligent video analytics covers tampering, directional/virtual line detection, defocus detection, enter/exit, and motion detection. 3