By now, everyone has heard the numbers. IoT is part of a networking revolution that is transforming the world. Experts predict that by 2020 there will be over 33 billion IoT devices deployed, or 4.3 Internet-connected devices for every man, woman, and child on the planet.
Of course, IoT is more than just one thing. There are a variety of IoT devices and categories, each with their own implications.
Consumer IoT includes the connected devices we are most familiar with, such as smart cars, phones, watches, laptops, connected appliances, and entertainment systems. Commercial IoT includes things like inventory controls, device trackers, and connected medical devices. Industrial IoT covers such things as connected electric meters, waste water systems, flow gauges, pipeline monitors, manufacturing robots, and other types of connected industrial devices and systems.
The implications for networks, and especially security, are huge. Increasingly, IoT devices are being woven into local, national, and global networks, including critical infrastructures, creating hyperconnected environments of transportation, water, energy, communications, and emergency systems. Healthcare agencies, refineries, agriculture, manufacturing, government agencies, and even smart buildings and cities all use IoT devices to automatically track, monitor, coordinate, and respond to events.
While automating decisions and processes at machine speeds can generate revenue, improve our quality of life, make us more productive, and even save lives, it also introduces new risks and widens the threat landscape.
- Some of the data passing from, to, or between connected devices contains personal information that can be exploited, including locations, names and addresses, ordering and billing information, credit card and bank information, medical records, government-issued ID numbers, etc.
- When compromised IoT devices are connected to IT networks, they can become a conduit for breaches or the injection of malware.
- Compromised industrial and commercial IoT devices can be used to make changes on the manufacturing floor. Operations technology, SCADA, and industrial control systems actually control physical systems, not just the bits and bytes of traditional IT networks, and even the slightest tampering can sometimes have far-reaching – and potentially devastating – effects.
- Increasingly, IoT is also being integrated into our critical infrastructure. Transportation systems, chemical refineries, wastewater systems, energy grids, culinary water, and communications systems all use IoT devices. The cascading effect of a serious compromise can be potentially catastrophic.
The challenge is that many IoT devices were never designed with security in mind. IoT security challenges include weak authentication and authorisation protocols, insecure software, firmware with hard-coded back doors, poorly designed connectivity and communications, and little to no configurability. And most IoT devices are “headless,” with limited power and processing capabilities. This not only means they can’t have security clients installed on them, but most can’t even be patched or updated.
The risk is real. Just recently, compromised IoT devices were gathered into a massive botnet, causing the largest denial of service outage in history. Unfortunately, the general response by the security industry has been woefully inadequate. Sure, the expo floor at this year’s RSA conference was filled with vendors promoting devices and tools to sooth the IoT worries of organisations.
The problem is that the network teams that need to test, deploy, manage, and monitor these devices are already overwhelmed. Dozens of isolated devices with separate management interfaces have placed a strain on limited IT resources. Large enterprises already need to manage an average of 30 security consoles, connected to hundreds of security devices that usually operate in isolation. This makes gathering threat intelligence a cumbersome and time-consuming task, often requiring the hand correlation of telemetry data in order to identify malware or compromised systems.
And now, specialised security tools being created and promoted for IoT are going to expand the number of deployed hardware-based and virtual security devices even further.
The reality is, IoT cannot be treated and secured as an isolated, independent network. It interacts across your existing extended network, including endpoint devices, cloud, traditional and virtual IT, and OT. Isolated IoT security strategies simply increase overhead and reduce broad visibility. Instead, security teams need to be able to tie together and cross-correlate what is happening across their IT, OT, IoT, and cloud networks. Such an approach enables visibility across this entire ecosystem of networks, allowing the network to automatically collect and correlate threat intelligence and orchestrate real-time responses to detected threats.
This requires a rethinking your security strategy. A distributed and integrated security architecture needs to cover your entire networked ecosystem, expand and ensure resilience, secure compute resources and workloads, and provide routing and WAN optimisation.
Fortinet is actively driving the development of IoT-specific security solutions. We already hold dozens of issued and pending IoT security patents that complement our patent portfolio and have been woven seamlessly into our Security Fabric framework.
