The advent of 5G and 400Gbps networks marks a significant turning point in the technological landscape, particularly for the Internet of Things (IoT). Faster, more reliable connections are opening the door to a wealth of new use cases, allowing more devices to be connected at any given time and providing organisations with the means to drive significant advancements across automation and efficiency.
While it is difficult to know the exact number of devices that are connected around the world – with estimates in 2023 ranging from between 15.14 billion to 41.76 billion – one thing is clear: the IoT is undergoing rapid and substantial growth. From agriculture to healthcare, manufacturing to transport and logistics, there are some exceptional examples of how the IoT is continuing to change the way in which services are provided across almost every sector.
Yet, as is often the case, the proliferation of this technology also brings additional risks. Each new device an organisation connects is an additional endpoint, meaning it is also another potential point of entry for hackers. In fact, according to Forrester’s ‘The State of IoT Security 2023’ report, IoT devices are now the most reported target for external attackers.
It is therefore imperative that, as IoT networks continue to evolve, so does our understanding of their potential vulnerabilities and what security measures can be introduced to protect them.
Understanding the risk
As more IoT devices are introduced, the complexity of managing the networks grows. This isn’t only a matter of scale; it also stems from the diversity of devices being integrated. Each device can come with its own operating system, along with varying protocols, standards, and security measures – which can ultimately lead to vulnerabilities and complications in protecting the network.
One prominent area of concern is that many of these devices are not designed with security as a primary focus. Some may be devoid of security features altogether, and even those that do include them will have often had them tacked on as an afterthought. This means that in many cases the devices lack security essentials, such as basic access controls and encryption, making them more susceptible to attack.
Additionally, the very nature of IoT devices can make them challenging to update or patch should a vulnerability be discovered. Limited processing power, the need for uninterrupted service and the diversity of operating systems can prevent users from making updates, or at least make updating devices a slow and complex process – particularly if the operating system isn’t Windows or Linux based. If a vulnerability is exploited, the ramifications can extend far beyond the device itself. Attackers can move laterally from the initial entry point, escalating their privileges and finding their way into additional systems and data reserves.
It is also important to understand that security threats in IoT devices can be hidden from view. The development process often involves a long supply chain, including chipset vendors, hardware vendors, software vendors and device manufacturers, with no individual party owning overall responsibility for the device’s security.
Mitigating the potential damage
This year will see the introduction of the UK government’s Product Security and Telecommunications Infrastructure (PSTI) Act, which marks a significant step towards enhancing the security standards of IoT devices. It aims to establish a more robust and secure framework for IoT products, addressing the often-overlooked vulnerabilities inherent in these devices. The existence of these regulations, however, should not lead to complacency when introducing new devices to a network.
It is important to exercise due diligence when expanding IT environments, thoroughly assessing the security implications of any additional device. This process should involve an evaluation of any built-in security features, an audit of the device provider, and careful consideration as to how the device is integrated within an existing network infrastructure.
It is also crucial that best security practices are then extended to cover any new devices that have been brought into the network. This includes ensuring they are kept up to date (where possible) and are regularly tested, as well as making sure that the staff using them have been given cyber awareness training and are familiar with any associated risks.
One of the most effective strategies for mitigating the risk associated with expanding your IoT network is the implementation of a Zero-Trust Network Access (ZTNA) framework. ZTNA operates on the principle of assumed comprise, meaning every request is verified and access is only granted to the required resources – limiting the potential damage of a breach by preventing compromised devices from being used as gateways into the broader network.
Expanding the IoT with caution
The burgeoning realm of the IoT offers remarkable potential for innovation and efficiency across almost every industry. It is, however, crucial to remain vigilant about the inherent risks associated with such growth. The integration of IoT devices into our daily operations is not just a technological advancement; it is a complex security challenge that requires a multifaceted approach.
The introduction of regulations like the UK’s PSTI Act is a commendable step towards standardising IoT security, but it doesn’t remove the risk completely. The responsibility still lies with organisations to proactively assess the security of their IoT devices, implement robust security practices, and foster a culture of cyber awareness among their staff.
As we continue to witness the rapid expansion of the IoT, it is clear that our approach to cybersecurity must evolve alongside it. The balance of risks and rewards is delicate, and though the potential of the IoT is exciting, we must still employ caution when considering and integrating any new devices.
