How to secure IoT devices in business

The Internet of Things (IoT) has become a core part of business operations worldwide. However, the growth and increasing complexity of a global network of smart devices have brought new security problems. It is no longer possible to ignore the risks posed by IoT devices, but fortunately, solutions are readily available.

In this blog, we’ll look at how IoT devices potentially compromise cybersecurity performance and how to mitigate IoT risks with security protocols and the latest technology.

Key takeaways

• IoT devices, from sensors to smart locks, lack inherent security, making a deliberate security strategy crucial.
• Attackers frequently exploit weak passwords and outdated firmware, underscoring the necessity for rigorous password policies and consistent updates.
• No device is too insignificant in the network of interconnected gadgets. Even the most basic can serve as a conduit for significant cyber threats.
• The stakes of IoT-induced data breaches are high, often unveiling sensitive details, highlighting the critical need to secure IoT devices.
• Physical security IoT technology, if compromised, can lead to theft and damage. Hence, it must be included in cybersecurity planning.
• Complete visibility and control over IoT devices are critical, with network segmentation and real-time monitoring forming the backbone of security.
• Implementing Zero Trust and SASE security architectures, aligned with best practices, can reinforce defenses across the increasingly complex IoT landscape.

What are IoT devices?

IoT devices are physical devices with internet connectivity that operate at a distance from traditional networks. IoT equipment communicates wirelessly and usually gathers information from the external environment.

This information could include temperature, moisture, or movement data. However, IoT sensors also increasingly cover highly specialized tasks like monitoring body functions.

IoT devices tend to be interconnected networks rather than stand-alone agents. They are also usually simplified compared to standard computers, routers, or mobile phones. As a result, they often lack on-board security software due to hardware limitations.

The Internet of Things operates in households, vehicles, workplaces, and even urban spaces. The IoT market has expanded rapidly, from $115 billion in 2016 to $478 billion in 2022, and could reach $2.4 trillion in 2029. 

Billions of devices already operate continuously as network endpoints, and the number is constantly rising. This growth also means that threat surfaces are rapidly expanding. Match that expansion with the security flaws inherent within IoT technology, and you have the perfect conditions for a cybersecurity storm.

Why is it critical to secure IoT devices?

Securing IoT devices is a vital component of modern network security. Companies could rely on massively distributed sensor networks or use a few smart security cameras to assist their on-premises operations. In any case, IoT security matters. Even devices as innocent as simple light sensors can bring heightened security issues. IT teams must include these risks in cybersecurity protocols.

Companies need proper IoT security practices to avoid potentially damaging new risks, expanding the attack surface through every connected device. For instance, attackers targeting smart devices might gain remote access to resources far beyond their initial network entry point, potentially harvesting sensitive data or mounting debilitating attacks. 

IoT risks are easy to overlook. Sometimes, security planners need to inventory every endpoint. Vendors may need to be more forthcoming about security features, vulnerabilities, or updates. And it’s easy to miss potential network connections from IoT devices to critical assets.

What are the major IoT devices threats and risks?

Here are the most common threats associated with IoT devices.

1. Lack of built-in security

Many IoT devices often lack built-in security measures to combat threats, focusing mainly on their primary functions. Remote access in IoT devices can lead to security headaches. Security gaps arise due to vendors investing little in firmware updates or long-term support, with some IoT devices becoming unsupported shortly after release. 

Moreover, unpatched backdoors and web application weaknesses can create access issues. Hence, users must develop robust security plans for all IoT devices and their management software, filling the void left by manufacturers.

2. Malware attacks

IoT vulnerabilities compromise individual devices and can escalate to full-scale network crises, such as a DDoS attack that overwhelms and incapacitates critical systems. Attackers often exploit weak passwords to enlist devices into botnets for large-scale attacks. 

While some malware may only cause minor nuisances, like turning devices into spam bots or crypto-miners, others have severe impacts. For example, botnets can power DDoS attacks that shut down networks, or malware can 'brick' devices, making them entirely inoperative.

3. Data loss

Data breaches top the list of corporate cyber threats, with insecure IoT devices frequently to blame for critical data exposure. A 2021 joint study by Viettel and Kaspersky Labs highlighted how flawed IoT links played a part in 16 significant breaches, impacting around 100,000 financial accounts. 

Similarly, Peloton faced issues where their fitness devices' vulnerabilities could reveal users' health, gender, and age data. These incidents highlight the need for secure IoT practices to protect sensitive information.

4. Physical security

Many companies rely on IoT technology in their physical security setups. For instance, they might use innovative door access systems or locks for their server centers. These devices are just as susceptible to attacks as any other IoT product.

Securing IoT devices like locks and cameras is crucial, as they're as vulnerable to attacks as any IoT product and essential to safeguarding against theft and damage. So, the physical aspect of IoT tech must be considered when protecting the integrity of data networks and critical assets.

5. IoT misconfigurations

IoT devices, if misconfigured, can bypass security measures, especially when default passwords like "123456" are used, as seen with numerous GPS trackers. Additionally, older IoT devices might use outdated firmware with unpatched vulnerabilities. 

Without dedicated efforts to secure IoT devices, outdated firmware, and weak passwords can leave networks vulnerable to prolonged exposure and attack.

Best practices for securing IoT devices in the workplace

Many IoT devices face several urgent security vulnerabilities and represent a significant risk to companies that use them. However, this is not a reason to abandon IoT tech. In any case, many companies depend on the IoT in day-to-day operations. Eradicating IoT is not an option.

The challenge is finding workable IoT security solutions without compromising performance. Here are some recommendations that could be part of an IoT security strategy:

1. Focus on device discovery and complete visibility

When securing IoT networks, the first step is creating a map of connected IoT devices. Security teams must know the precise number of devices in use alongside manufacturer IDs, serial numbers, hardware, and firmware versions.

Record any specialist features that attackers could exploit. For example, many IoT products use communication protocols such as NFC, Bluetooth, LoRA, or nRF24. Please be sure to note down any devices that rely on GPS communication as well.

Automated scanning tools can map connected devices. Enter the data generated into a regularly updated inventory alongside a risk profile for every device. Make devices a security priority if they interact closely with critical resources and data centers or process high-value data.

The device map and risk profiles can feed into other security strategies, such as network segmentation, ensuring that IoT endpoints are separate from core data assets.

2. Apply network segmentation

Network segmentation is the process of dividing networks into discrete sections. Users can access portions of the network provided they possess sufficient privileges or contained if they do not have the required permissions.

Segmenting networks reduces the attack surface available to attackers, meaning that cybersecurity incidents are localized and do not ripple throughout the entire network. In the IoT context, this allows security teams to separate insecure connected devices from data centers or applications.

3. Prioritize IoT updates

IoT vendors may not offer automated updates or even provide customer alerts when firmware updates become available. Security teams should never assume that IoT software is current and capable of meeting emerging threats. Instead, an active updates strategy is required.

Administer any required security patches for IoT equipment at the installation stage. Vendor websites should provide the latest versions. Avoid any devices without recent updates, if possible. Disabling features that aren't essential is also a good idea, as is avoiding Universal Plug and Play connectivity. UPnP may be convenient, but when used across networks, it makes it much easier for cybercriminals to map potential attack routes.

Additionally, schedule update audits to renew firmware throughout the lifecycle of IoT tools. Ideally, vendors will collaborate with companies to ensure up-to-date protection, but proactive investigation of security patches may also be necessary.

4. Use secure password practices

As noted earlier, IoT products often ship with default passwords. These passwords are easy to guess but may not be changed when companies install devices, creating a simple entry point for attackers.

Make strong passwords to protect IoT devices. Every device should have a unique password, which should change regularly. An enterprise-wide password manager can help automate updates and avoid human error.

Some devices, such as physical locks or cameras, also support multi-factor authentication (MFA). MFA adds another layer of access control above simple passwords.

5. Employ real-time IoT monitoring

Combine device visibility with monitoring to track traffic across IoT nodes and detect unusual activity before crises emerge. Modern network security management systems provide tools to monitor network traffic continuously, including every connected device.

Monitoring tools also allow security teams to set a baseline for normal network functioning. This baseline acts as a standard to detect anomalies and can be used to optimize network performance alongside threat detection.

6. Router security and encryption

Few IoT products come with embedded encryption, but companies can add cryptography above devices as an additional security measure.

Having a secure router is also essential. Set IoT router encryption to the highest level compatible with network performance. Configure IoT routers with a secure password, pick device and network names that differ from defaults, and separate routers from other assets via network segmentation.

Complete separation may not be possible. However, robust barriers between an IoT network and standard network architecture help to contain threats if they arise.

Combine IoT device security with Zero Trust & SASE

Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE) provide a way to synthesize many of the solutions suggested above.

ZTNA is a set of ideas based on the principle of least privilege. Users are never trusted until verified, while resources are locked down until evidence is provided that users have the required privileges.

SASE is a suite of cloud-based technologies that provides in-depth network edge protection. Identity Access Management (IAM) and network micro-segmentation guard against malicious intruders, including agents entering networks via IoT endpoints.

SASE includes the ability to automate device scanning and traffic monitoring - both major benefits when managing large numbers of IoT devices. Security policies for each IoT device can be delivered automatically, and a centralized console allows for real-time threat surveillance.

SASE and ZTNA work together to ensure that rogue IoT endpoints are separated from the wider network while enabling legitimate traffic to flow unimpeded. It’s the ideal option for companies reliant on the IoT.

How NordLayer can help you achieve IoT security

NordLayer offers a range of IoT security solutions to implement Zero Trust-based IoT protection. 

Our SASE networking products allow for granular controls, in-depth monitoring, easy device management, and optimized traffic speeds. Inventory all connected IoT equipment, manage updates, and make it easier to spot threats before they cause critical issues. And use simple Identity Access Management (IAM) tools to authenticate every user before they can access core resources.

IoT tech doesn’t have to be a security minefield. Contact our team today to discover how to protect against IoT threats and safeguard core network assets.