Security risks have significantly increased with the rise of connected IoT devices. According to an OpenDNS IoT study, “23% of respondents said they have no mitigating controls to prevent unauthorized device access in their company’s networks.” Traditional approaches to securing end-point devices will be impractical in the IoT era. More connected devices on the company’s network mean more risks, translating to a greater need to invest in security solutions.
CHALLENGES LEAD TO RISK
IoT is becoming more relevant in everyday business functions, particularly for fleet management, retail and manufacturing. Employees at almost every company, though, are bringing IoT devices (wearables, mobile phones, tablets, etc.) onto the corporate network, creating more vulnerable endpoints.
Biggest security risks with the increase of IoT:
Biggest challenges in IoT security:
- IoT devices lack basic security requirements
- IoT devices have numerous standards and protocols that create security blind spots
- The volume and scale of IoT deployments make it nearly impossible to have visibility into all potential security threats
- Lack of internal responsibility regarding IoT, privacy and security
When assessing your existing security posture, consider the following questions:
- What’s your company’s BYOD policy?
- What current security policies do you have in place? What is your current investment strategy in upgrading and enhancing security for your organization?
- How many remote employees do you have?
- Who manages patches and upgrades to your network security environment?
- Is your main source of security an internal hardware system? (i.e., a firewall)
- What is your security vulnerability disclosure policy and handling process?
- Do you have a testing and analysis framework to know where possible vulnerabilities are?
- Pending the industry you’re in, do you practice encryption best-practices?
- Pending how you store data, what safeguards are in place to secure and mitigate risk of data exposure when transmitting and receiving?
A Layered Approach
Many connected devices are not built with a security-first approach. Small businesses might be reliant on Wi-Fi routers that are lacking current firmware. Traditional hardware security, corporate firewalls, Unified Threat Management (UTM), and routers are good places to start to protect endpoints on the LAN, but are they enough? Ultimately, it’s too many endpoints to look after. With more devices coming onto a company’s network, too many alerts get past firewalls and routers, and eventually your IT team won’t have the resources, time or attention to determine what’s critical and what’s benign.
The future of security is virtualized and managed where alerts can adequately be filtered, identified, and determined to be critical in nature and what requires action. Consider the following to keep your business protected:
- UTM solutions that protect both the WAN and LAN
- Network-based security
- Managed security solutions (detection and response services)
- Private, public, hybrid and multi-cloud security solutions to protect users, data and applications
- Internal network firewall segmentation
- Mobile Device Management (MDM)
- IoT device-specific security measures (authentication and encryption)
- DDoS mitigation solutions
- Threat intelligence and analysis
An alternate route would be to leverage a Managed Service Provider (MSP) that provides both thought leadership and the management of the entire environment.
Read more about Enterprise Security here.