5 biggest IoT security challenges and how to fix them

The global market for the Internet of things (IoT) reached 100 billion dollars in revenue for the first time in 2017, and reports suggest that this figure will grow to around 1.6 trillion dollars by 2025.

The analysis reflect that the technology is predicted to step far ahead than anyone can possibly imagine. But with the increase in the popularity of IoT devices, there will be a rise in app development as well as security risks and challenges.

But first let us learn what is the Internet of Things or IoT?

The IoT refers to the millions of physical devices around the globe that are connected to the internet, all sharing and collecting data. Due to the ubiquity of wireless networks and arrival of cheap computer chips, it’s possible to turn anything, from something as small as a pill to something as big as a helicopter, into a part of the IoT. An IoT device could be as serious as a driverless truck or as fluffy as a child’s toy. Connecting all these different things and adding sensors to them adds a level of digital intelligence to such devices that would otherwise be dumb, enabling them to communicate real-time data without involving a person. The IoT is making the fabric of the world around us more responsive and smarter, merging the digital and physical universes.

In October 2016, a group of hackers found a vulnerability in a specific model of security cameras. Around 300,000 IoT video recorders then started to attack multiple social network websites and brought down Twitter for almost two hours. This attack is just one of the examples of what can happen to IoT devices with poor security.

It is not only video cameras, but anything with an internet connection, from light bulbs to smart locks, refrigerator, thermostats, vehicles, and even smart toys. Using these devices always poses IoT security challenges and risks to overcome.

IoT Security Challenges

IoT is useful in many ways. However unfortunately, technology has not matured yet and it is not entirely safe. The entire IoT environment has many security challenges such as:

1. Physical hardening — Physical access to IoT devices can pose risk if such devices are not hardened against the physical attack. These attacks may not be intended to damage the device, but to extract information. Simple removing a microSD memory card to read its contents can give an attacker private data as well as information such as embedded passwords that may allow access to other devices.

2. Manufacturing standards — New IoT devices come out almost daily, all with undiscovered vulnerabilities. The main source of most IoT security issues is that the manufacturers do not spend enough time and resources on security. For example — a smart refrigerator can expose Gmail login credentials and a smart fingerprint padlock can be accessed with a Bluetooth key that has the same MAC address as the padlock device.

3. Lack of user knowledge and awareness — Over the years, Internet users have learned how to perform virus scans on their PCs, avoid spam emails and secure their WiFi networks with strong passwords.

However, IoT is a new technology and people still don’t know much about it. While most of the risks of IoT security issues are on the manufacturing side, business processes and users can create bigger threats.

As per data, 98% of all IoT device traffic is unencrypted, exposing confidential and personal data on the network. This allows attackers to collect personal information and then exploit it for dark web gains.

4. IoT security problems in device update management — Another source of IoT security risks is insecure firmware or software. Although a manufacturer can sell a device with the latest software update, it is almost inevitable that new vulnerabilities will come out.

Updates are absolutely critical for maintaining security on IoT devices. They should be updated immediately after new vulnerabilities are discovered. Still, as compared with computers or smartphones that get automatic updates, some IoT devices continue being used without the necessary updates.

Another challenge is that during an update, a device will send its backup out to the cloud and will suffer a short downtime. If the connection is unencrypted and the updated files are unprotected, a hacker could steal confidential information.

5. Botnet Attacks — A single IoT device infected with malware does not pose any real risk; it is a collection of them that can bring down anything. To perform a botnet attack, a hacker creates an army of bots by infecting them with malware and directs them to send thousands of requests per second to bring down the target.

Much of the uproar about IoT security began after the Mirai bot attack in 2016. Multiple DDoS (Distributed Denial of Service) attacks using hundreds of thousands of IP cameras, NAS, and home routers were infected and directed to bring down the DNS that provided services to platforms like Airbnb, Twitter, GitHub, Netflix, and Reddit.

Ways to overcome IoT Security Challenges

1. Secure your IoT network — To avoid interceptions from rogue devices or other potentially harmful cyber-attacks, you need to protect and secure the network that’s connecting various IoT devices. The traditional endpoint security you use should include:

· Anti-malware

· Firewalls

· Antivirus

Of course, this is the bare minimum and step one for a reason. Hence don’t stop here!

2. Use IoT data encryption — If you are serious against protecting the privacy of users and preventing data breaches, you need to encrypt the data at both rest and in-transit between IoT devices.

This can be done by using IoT encryption algorithms. Whether the keys you use are asymmetric or symmetric, this is an important step in protecting users.

3. Authenticate IoT devices — As well as using encryption keys to protect users, you also should allow users to authenticate IoT devices.

This is done by introducing some multiple user management features for a device and then implementing mechanisms, such as:

· Two-factor authentication

· Biometrics

· Digital certificates

4. Test, test and keep testing (and updating) — IoT devices need proper testing throughout their lifecycle. That means before it’s released to the public and while it’s on the market.

As mentioned before, smartphones and laptops circumvent this through automatic updates. However, IoT manufacturers often fall foul by rarely providing updates or none at all. This is a dangerous game. It only takes one serious breach for you to lose customers or your reputation. So, if you want your IoT device to have longevity, regularly test and update!

5. Stay up to date and stay vigilant — As we can see, the larger the world of IoT becomes, the greater the importance of prioritising IoT data security and privacy.

Unfortunately, cyber-attacks and rogue devices will not go anywhere, and they will only get smarter. Therefore, we recommend you remain up to speed with the latest attacks and always keep working on providing the best security and privacy features you can. This not only helps you guard against data breaches, but it also builds confidence and trust in your product.

We have seen the emergence of IoT as a trend in the last few years. There are smart devices coming out that we never thought needed an Internet connection: smart toothbrushes, tables, pillows, beds, and the list continues to grow. The world is turning into a network of objects collecting our personal, sensitive information.

We can only imagine the amount of important data hackers could steal from those IoT devices if they do not have proper security. So, the top IoT security threats listed above are just the beginning. If we want our devices smart, we need them to be secure as well.

We at DSSG empower our clients and their workforce with cutting-edge transformative solutions and data-driven insights. Are you and your organisation ready to shift the mindsets and get the most out of innovations?