Mitigating IoT security threats
Connecting state and local government leaders
Remote work has exacerbated an already-tricky problem for IT managers: internet of things security.
It’s getting harder for government agencies to get a handle on the number of devices connecting to their networks. For example, workers who went from onsite to remote work in March found they often had to use whatever hardware they could, including personal devices, to access the data and applications they needed to do their jobs. The situation has exacerbated an already-tricky problem for IT managers: internet of things security.
“The first question I always ask a CISO is, ‘How confident are you that you know exactly what is connected to your network?’ and I have never once had a CISO say, ‘I am completely confident or even very confident that I know everything that is connected,’” said Greg Murphy, CEO of Ordr, an IoT security company. “It’s this massive volume of connected devices with very, very different behavior patterns.”
Another challenge agencies face in securing IoT is the sheer scale. For instance, the Veterans Health Administration is the largest integrated health care system in the country, providing care at 1,255 facilities. There’s no way it can have visibility into all the devices that could connect to its network, from Amazon Echo devices to automated parking lot gates, Murphy said.
When it comes to IoT devices, “we’re not talking about the jetfighters and tanks. We’re talking about the government organizations that are bringing in consumer and commercial gear to address problems in their space,” said Brad Ree, CTO of the ioXt Alliance, a 300-member organization that works to improve IoT security. “IoT devices become wonderful launching points for attackers into the network.”
Federal agencies are more likely to be targeted not only by malicious criminals, but also by state actors. Plus, their obligation to ensure that banned products such as Huawei devices are not accessing the network raises their compliance urgency, Murphy added.
“It’s a really daunting challenge, and, frankly, it’s one no human being can solve,” he said. “You know malicious actors are going after and are targeting these federal organizations. That is beyond question. The question is how do you make sure you are prepared?”
Both experts offered immediate steps agencies can take to harden their IoT security.
“The first thing that agencies have to be able to do is understand what is connected to their network at a deep level: What is the device? What software version is it running?” Murphy said.
Second, he recommended segmenting the network and regulating traffic among devices so that if a breach happens, hackers can’t access other infrastructure.
“We recommend that at minimum, you isolate your IoT from your corporate networks,” Ree said.
Lastly, agencies should practice basic cyber hygiene through automatic patching and by staying on top of known threats. For instance, agencies should periodically consult the National Institute of Standards and Technology’s National Vulnerability Database to see what has been disclosed and check Shodan, a site that publishes IP addresses that are potentially running known vulnerabilities, Ree said.
But security can start before anything connects, he added.
“When government agencies are buying or putting out requests for products, they should ask their vendors just simply, ‘What security standards do you follow?’” he said. “If the vendor comes back with a blank answer on that, you might want to do some probing.”
Federal leaders are aware of the IoT security challenges. Last month, the House passed the IoT Cybersecurity Improvement Act, which “would improve the cybersecurity of Internet-connected devices by requiring that devices purchased by the U.S. government meet certain minimum-security requirements,” according to a press statement from Sen. Cory Gardner (R-Colo.), who reintroduced the bill with Sen. Mark Warner (D-Va.) in March 2019.
The bill would make NIST responsible for creating IoT standards in conjunction with industry, and it would assign the Office of Management and Budget to create guidance for agencies to comply with those standards. Additionally, the Department of Homeland Security would be required to publish guidance on vulnerability disclosures for contractors and vendors, which promotes transparency, Ree said.
“It helps drive an American leadership approach in IoT security, so we don’t repeat the issues like with [the European Union’s General Data Protection Regulation], where basically we’re being pulled along without having the United States or its citizens … having input into those regulations,” he said.
NEXT STORY: Making privacy an easier conversation