A two-pronged strategy for IoT security awareness

The full-blown internet of things may seem far in the future, but IT decision-makers need to address it now. “Smart home” applications are becoming commonplace in the consumer world, and IoT adoption is growing quickly in the enterprise. Given that IoT is all about collecting and sharing data from a broad range of endpoints, this trend will have an impact on the security of government agencies.

As internet-enabled sensors become embedded in a wide range of workplace hardware -- devices, endpoints and more -- we will soon enter the era of the “smart enterprise.” Unfortunately, agencies' aging IT infrastructure is simply not natively equipped for what’s coming.

IoT exploits accidents and vulnerabilities. To take only one example, in January 2018, it was discovered that a fitness tracking app revealed locations of U.S. military personnel in Iraq and Syria.

Some legislation is already on the books to try to counter the vulnerability. The IoT Cybersecurity Improvements Act of 2019 requires the National Institute of Standards and Technology to issue recommendations for secure development of identity management, patching and configuration management for IoT devices. The Office of Management and Budget would then issue guidelines based on these recommendations, and review them every five years.

It also requires any internet-connected devices purchased by the federal government comply with those recommendations. Contractors and vendors providing IoT devices to the government must adopt coordinated vulnerability disclosure policies to disseminate information on any identified vulnerabilities.

But the problem can’t be solved by legislators and vendors alone. Federal IT professionals must ensure that the data flowing to and from these “things” can be trusted. Even in these early days of IoT, security threats already are apparent -- and we don’t know what future threats will look like.

Agencies must create a security awareness strategy around IoT, especially to protect data at the network edge. This strategy has two components.

Strategy component #1: The IoT ecosystem

The IoT ecosystem now extends beyond conventional network elements such as switches, routers and servers. Consider devices or “things” that can be IoT-enabled via wireless connectivity: employee ID badges, file cabinets, office doors and restricted areas (like data centers). There is almost no limit to the variety of edge elements.

Data security considerations also must apply to a wider pool of vendors and original equipment manufacturers (OEMs). Suppliers must ensure that IoT security is built-in at the source -- especially when legacy networks cannot be modernized fast enough to manage IoT from the inside.

Another aspect of the IoT ecosystem concerns security for devices' full lifecycle. The starting point will be when new IoT devices are deployed, provisioned and added to the network, but there are ongoing stages where data integrity also must be protected.

As new devices are added, older IoT devices may need to be removed and decommissioned. There will also be ongoing updates to IoT software or firmware, and these must be managed securely. The same holds for any maintenance required on these devices.

The common element in all these scenarios is the hardware security module, which safeguards the encryption keys and digital identities. HSMs are the “trust anchor” ensuring that the data generated by edge devices comes from a trusted source. They are intended to provide protection from cyberattacks targeting IoT edge devices and to identify threats before they hit networks.

Strategy component #2: IoT best practices

Best practices will change as IoT evolves. Agencies should take some advice from the private sector for such practices -- not just in the enterprise, but also among OEMs selling into government.

There are two elements to consider here, starting with what employees are bringing into the workplace from their personal lives. Bring-your-own-device policies where staff use their smartphones for work raise legitimate IoT security considerations. These devices may not have direct access to the network, but because they are consumer-grade, they are not held to enterprise standards.

Because IT has no control over the use of these devices (or even knowledge of their presence at work) they are a potential vulnerability when using connectivity tied to the network.  Agencies must understand that these devices will have limited security and that their users may rely on default settings or use weak passwords.

Proactive worker education will be essential. As IoT devices become more common, employees should also have a higher awareness of their data security risks. If so, best practices stand a better chance of taking root. The key is to strike a balance between giving employees enough flexibility to use their preferred devices, while not being too restrictive or controlling.

The second element would be development of guidelines that keep data secure in the workplace, but also can be used as selection criteria for IoT OEMs and partners. Standard best practices for general data security would apply to connected devices as well, but with IoT being an emerging trend, more specific guidance will be needed.

Ensure the use of strong passwords or authentication steps for any IoT-enabled device used for work -- either in the office or remotely. Also, IoT-enabled communications devices (especially anything with a camera or a microphone) have an extensive set of connectivity options, often beyond what users are aware of.  A basic checklist for employees to follow to improve security can go a long way to blocking out cyberattacks targeting an agency's network.

Finally, encryption should be the standard for all data traffic with IoT-enabled devices.  Employees must avoid using devices with unsecured connectivity, and IT should propose that all IoT vendors support encrypted traffic.

It may not seem that IoT has present-day implications for IT decision-makers. As sensors become smaller and more powerful, however, this the technology is becoming quite pervasive, and new security risks could be quite significant.

That’s why it’s important to adopt a proactive IoT-centric data security posture now. Agencies must understand the security risks that come with this new layer of connectivity and how objects across the broad IoT ecosystem can become cyberattack targets. Security strategies must address not only how workers interact with internet-enabled devices and endpoints, but how the agency deals with IoT technology partners across the supply chain.