Mitigating IoT Cyber Risks: Training Is The First Step

The Internet of Things (IoT) is increasingly becoming an integral part of our everyday lives. From fridges to watches to Alexa virtual assistants and the cars we drive, more and more households are introducing IoT devices into their daily routines.

In fact, it’s projected that the number of IoT devices will reach 125 billion by 2030. However, while the concept of a truly connected lifestyle is an exciting one, it also introduces a number of new risks.

Recent news that plumbers are receiving cybersecurity training due to an increase in smart heating devices further highlights that cybersecurity is broadening its reach into various trades because of IoT. Roles which five years ago we would never have thought of as requiring cybersecurity training, will need it as adoption of connected devices for business continues to rise.

As homes become more connected, the tradespeople who install and service IoT devices need to be more aware of the cyber risks associated with them, particularly when they involve personal information.

Many of the smart devices being used within the home currently lack basic cybersecurity provisions, which could lead to the theft of personal data and the intrusion of private spaces and networks. Security is needed to protect IoT integrity and to reduce the risk that it may be used for hostile purposes, so there is a real necessity to educate people who work closely with IoT devices around how to detect and deal with a security issue.

That is not to say that the rise of IoT adoption, both in a consumer and industry sense, is not a positive. Introducing a more connected world means an increase in productivity and efficiency, with companies being able to analyze the data from a device – whether that is a smart meter, boiler or even lights – and respond to customer issues much quicker.

But realizing the potential of these connected devices should be considered alongside the introduction of robust security measures.

Most importantly, for any company or individual working within the IoT space is to understand how the IoT system works as a complete system. A lot of people only think about the individual device, for example, an engineer who has traditionally worked with unconnected machines where there is no need to think about the whole estate, and forgets the fact that an entire eco-system is connected to that one device.

An IoT device is also connected to the company it was developed by and the entire network of similar devices through the applications, databases and reports its data feeds into. So, in just a couple of hops, your house is connected to thousands or millions of others. Each device connection contains potential risk, which is what makes the whole network vulnerable to attackers.

Organizations need to instigate the education of a wider understanding across all employees that one device is linked to an entire community and data constantly going in and out of this community. Understanding the complete system with its applications, databases and reports gives a greater perspective to the different routes and vulnerabilities a hacker could take advantage of.

An engineer must be able to understand the data flow between the device and the eco-system so that they can identify issues, including a breach should it happen. They should be able to understand weaknesses in the system and how devices can be kept updated with patches as they are being serviced. Understanding this bigger picture is vital to mitigating the security risks involved in IoT adoption. 

Furthermore, the public also needs to be made aware of the new risks involved in integrating IoT devices. For example, someone could turn up to the house to allegedly service a smart-meter, but instead access the house and its Wi-Fi and install malware onto the network. This then enables an attacker to steal critical personal data or use systems as part of a botnet.

In recent news, a criminal organization has even hacked cashpoints by installing devices which steal credit card information as it enters the ATM. Of course, it doesn’t have to be malicious, it could be an error by a legitimate installer.

At the simplest level, forgetting to change the default password on the device, through to a compromised laptop which when attached to a home network seeks out other connected devices to install malware on.

While the rise in IoT means our day-to-day is becoming more connected and essentially streamlined, it is vital to educate everyone, from plumbers and engineers to the general public, in the risks involved with adopting increased connectivity and how it can be mitigated.

The government recognizes the need and is putting money into cybersecurity training for services personnel, this needs to be matched by businesses to continue to build trust between consumers and the next generation of connected technology.

Infosecurity:

You Might Also Read:

Internet Of Things Brings Threats To Security

« Darktrace - From Cybersecurity Start-Up To Unicorn
Fraudsters £350k Spoof University Emails »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Protective Intelligence

Protective Intelligence

Protective Intelligence brings together a group of information security specialists with a passion for delivering high-quality solutions.

HANDD Business Solutions

HANDD Business Solutions

HANDD are independent specialists in data protection with expertise at every stage of the Protect, Detect and Respond cycle, from consultancy and design, right through to installation.

idappcom

idappcom

idappcom provides unique industry approved software solutions for auditing and enhancing the threat recognition and response capabilities of your corporate security defences.

ThreatAdvice

ThreatAdvice

ThreatAdvice is a provider of cybersecurity education, awareness and threat intelligence.

Cellopoint

Cellopoint

Cellopoint is a leading manufacturer of information security and email lifecycle management (ELM) products.

Cycode

Cycode

Cycode is the industry’s first source code control, detection, and response platform.

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference (AtlSecCon)

Atlantic Security Conference is a non-profit, annual, information security conference located in Halifax, Nova Scotia, Canada.

Sequoia Capital

Sequoia Capital

Sequoia Capital is a venture capital firm focused mainly on technology. We partner both with young companies finding their stride and established ones looking for growth.

Palantir

Palantir

Palantir software empowers entire organizations to answer complex questions quickly by bringing the right data to the people who need it.

Adarma Security

Adarma Security

Adarma are specialists in threat management including SOC design, build & operation.

SignalSEC

SignalSEC

SignalSEC provides vulnerability intelligence, malware analysis, penetration testing and associated training services.

Lancera

Lancera

Lancera provides growth accelerating Software Development, Web Presence and Cybersecurity Solutions with a focus on customer happiness.

Airtel Secure

Airtel Secure

Airtel Secure’s multi-layered, full service cybersecurity offerings are designed to safeguard enterprises against threats of various kinds and origins.

Inspectiv

Inspectiv

Inspectiv offers a turn-key solution to continuously identify security vulnerabilities and provide security assurance.

Deutsche Gesellschaft für Cybersicherheit (DGC)

Deutsche Gesellschaft für Cybersicherheit (DGC)

As a leading provider of cyber security, DGC supports companies in taking advantage of the opportunities offered by the digital transformation – and in minimizing the associated risks.

Zyber 365

Zyber 365

Zyber 365 are providing a robust, decentralized, and cyber-secured operating system which adheres to the fundamental principles of environmental sustainability.