Mitigating IoT Cyber Risks: Training Is The First Step
The Internet of Things (IoT) is increasingly becoming an integral part of our everyday lives. From fridges to watches to Alexa virtual assistants and the cars we drive, more and more households are introducing IoT devices into their daily routines.
In fact, it’s projected that the number of IoT devices will reach 125 billion by 2030. However, while the concept of a truly connected lifestyle is an exciting one, it also introduces a number of new risks.
Recent news that plumbers are receiving cybersecurity training due to an increase in smart heating devices further highlights that cybersecurity is broadening its reach into various trades because of IoT. Roles which five years ago we would never have thought of as requiring cybersecurity training, will need it as adoption of connected devices for business continues to rise.
As homes become more connected, the tradespeople who install and service IoT devices need to be more aware of the cyber risks associated with them, particularly when they involve personal information.
Many of the smart devices being used within the home currently lack basic cybersecurity provisions, which could lead to the theft of personal data and the intrusion of private spaces and networks. Security is needed to protect IoT integrity and to reduce the risk that it may be used for hostile purposes, so there is a real necessity to educate people who work closely with IoT devices around how to detect and deal with a security issue.
That is not to say that the rise of IoT adoption, both in a consumer and industry sense, is not a positive. Introducing a more connected world means an increase in productivity and efficiency, with companies being able to analyze the data from a device – whether that is a smart meter, boiler or even lights – and respond to customer issues much quicker.
But realizing the potential of these connected devices should be considered alongside the introduction of robust security measures.
Most importantly, for any company or individual working within the IoT space is to understand how the IoT system works as a complete system. A lot of people only think about the individual device, for example, an engineer who has traditionally worked with unconnected machines where there is no need to think about the whole estate, and forgets the fact that an entire eco-system is connected to that one device.
An IoT device is also connected to the company it was developed by and the entire network of similar devices through the applications, databases and reports its data feeds into. So, in just a couple of hops, your house is connected to thousands or millions of others. Each device connection contains potential risk, which is what makes the whole network vulnerable to attackers.
Organizations need to instigate the education of a wider understanding across all employees that one device is linked to an entire community and data constantly going in and out of this community. Understanding the complete system with its applications, databases and reports gives a greater perspective to the different routes and vulnerabilities a hacker could take advantage of.
An engineer must be able to understand the data flow between the device and the eco-system so that they can identify issues, including a breach should it happen. They should be able to understand weaknesses in the system and how devices can be kept updated with patches as they are being serviced. Understanding this bigger picture is vital to mitigating the security risks involved in IoT adoption.
Furthermore, the public also needs to be made aware of the new risks involved in integrating IoT devices. For example, someone could turn up to the house to allegedly service a smart-meter, but instead access the house and its Wi-Fi and install malware onto the network. This then enables an attacker to steal critical personal data or use systems as part of a botnet.
In recent news, a criminal organization has even hacked cashpoints by installing devices which steal credit card information as it enters the ATM. Of course, it doesn’t have to be malicious, it could be an error by a legitimate installer.
At the simplest level, forgetting to change the default password on the device, through to a compromised laptop which when attached to a home network seeks out other connected devices to install malware on.
While the rise in IoT means our day-to-day is becoming more connected and essentially streamlined, it is vital to educate everyone, from plumbers and engineers to the general public, in the risks involved with adopting increased connectivity and how it can be mitigated.
The government recognizes the need and is putting money into cybersecurity training for services personnel, this needs to be matched by businesses to continue to build trust between consumers and the next generation of connected technology.
You Might Also Read:
