Securing the IoT Environment

The Internet of Things (IoT) is growing massively, yet it also has a deepening security problem. 

“Everything from the gateway down to the device is kind of the Wild West, and this new frontier is not an area that we’ve spent much time figuring out how to secure,” says Mike Krell, lead IoT analyst for research firm Moor Insights & Strategy. 

Despite mounting security concerns, the IoT market continues a rapid expansion. A study sponsored by Aruba Networks recently found that 85 percent of businesses will implement an IoT strategy by 2019, driven by the need for innovation and business efficiency. The study also found that 88 percent of organizations already report a return on investments in IoT. 

Given the mission-critical nature of many IoT applications, it’s easy to see why data needs to be protected. Yet IoT devices currently are not being built with security as a primary consideration. 

“By design, traditional IoT devices often lack even basic security protections, opting instead to focus on ease of use and affordability,” says Marc Laliberte, an information security threat analyst for security provider WatchGuard Technologies. “Even industrial IoT devices and medical equipment often remain vulnerable to basic attacks due to difficulties with patching security flaws.” 

If IoT devices can’t be fully protected, then the surrounding environment needs to be secured. This approach requires multilayered, scalable security including firewalls, encryption, identity and access management, and network segmentation.

Next-Generation Firewalls 

A next-generation firewall (NGFW), a hardware- or software-based network security system, can detect and block attacks by enforcing security policies at the application, port and protocol levels. “Looking at security best practices, the NGFW provides some of the most critical ingredients of total IoT protection,” notes Yariv Fishman, head of IoT security for Check Point Software Technologies. 

“NGFW appliances provide critical services like an intrusion prevention system (IPS) to detect and block exploitation of IoT devices without interfering with network access,” Laliberte adds. An IPS continuously examines network traffic flows to detect and prevent vulnerability exploits. 

Encryption 

Encryption plays an important role in securing IoT devices as well as network communications. “For example, establishing an encrypted virtual private network (VPN) connection between a device and the network helps eliminate potential attacks, such as ‘Man in the Middle,’ that compromise the integrity and validity of the information provided from the device to the network and vice versa,” Fishman says. 

Network connectivity built into IoT devices enables both remote monitoring and management. “These remote access connections more often than not opt for simplicity over security, using unencrypted HTTP instead of HTTPS, or even Telnet instead of Secure Shell (SSH),” Laliberte says. One of the biggest mistakes IoT network administrators can make when enabling remote access to IoT devices is simply forwarding such insecure protocols through the perimeter firewall. “Instead, they should use encrypted VPN solutions to allow remote access to their network, and ultimately the specific IoT devices, in a simple and secure way,” Laliberte suggests. 

Yet encryption should be just one element in a holistic security strategy. “Security is only as good as its weakest link on the network,” Fishman says. “Therefore, having encryption helps mitigate some of the potential risks in an IoT network, but not all of them.” 

Identity and Access Management 

IAM provides mechanisms for authenticating, authorizing and auditing identities and access privileges of users and devices. “Traditionally, IAM was mostly focused on individuals; now it’s expanded from individuals to actual end devices,” Krell observes. 

IAM tools have gradually gained the ability to manage hundreds of thousands — even millions — of interconnected “things,” as well as the people who communicate with IoT assets. “The digital identity of these devices is key to securing the IoT,” says Leon Adato, “head geek” at SolarWinds, an IT infrastructure management company. “As the IoT becomes a more critical component of business and everyday life, an identity solution that can connect with anything and support IoT ecosystems, users, services and their relationships becomes necessary.” 

Network Segmentation 

Partitioning a network into secure segments helps isolate IoT devices from mainstream IT devices. “Network segmentations enhances IoT security simply by mitigating the risk that one part of the network will be able to influence other parts,” Fishman says. “By doing so, we are keeping potential threats within a controlled environment without being able to extend the threat to other parts of the network.” 

While traditional network endpoints typically run endpoint protection services, that’s not true for IoT devices. “If an attacker is able to compromise an IoT device, they could sit there for months undetected while carrying out attacks behind your network perimeter,” Laliberte warns. “Because of this threat, IoT devices should be segmented from the rest of the network by an NGFW performing inspection on internetwork connections.” 

The Last Line of Defense 

Once there’s collective agreement about how many IoT devices will be in your environment, it’s up to the user to formulate a security policy incorporating best practices, Adato says. “You may also need to consider Payment Card Industry, Health Insurance Portability and Accountability Act and other compliance issues,” he notes. “The management burden falls to you, as the IT professional, to ensure that both your organization’s and end-users’ data is protected.”