Mitigating IoT Cyber Risks: Training Is The First Step

The Internet of Things (IoT) is increasingly becoming an integral part of our everyday lives. From fridges to watches to Alexa virtual assistants and the cars we drive, more and more households are introducing IoT devices into their daily routines.

In fact, it’s projected that the number of IoT devices will reach 125 billion by 2030. However, while the concept of a truly connected lifestyle is an exciting one, it also introduces a number of new risks.

Recent news that plumbers are receiving cybersecurity training due to an increase in smart heating devices further highlights that cybersecurity is broadening its reach into various trades because of IoT. Roles which five years ago we would never have thought of as requiring cybersecurity training, will need it as adoption of connected devices for business continues to rise.

As homes become more connected, the tradespeople who install and service IoT devices need to be more aware of the cyber risks associated with them, particularly when they involve personal information.

Many of the smart devices being used within the home currently lack basic cybersecurity provisions, which could lead to the theft of personal data and the intrusion of private spaces and networks. Security is needed to protect IoT integrity and to reduce the risk that it may be used for hostile purposes, so there is a real necessity to educate people who work closely with IoT devices around how to detect and deal with a security issue.

That is not to say that the rise of IoT adoption, both in a consumer and industry sense, is not a positive. Introducing a more connected world means an increase in productivity and efficiency, with companies being able to analyze the data from a device – whether that is a smart meter, boiler or even lights – and respond to customer issues much quicker.

But realizing the potential of these connected devices should be considered alongside the introduction of robust security measures.

Most importantly, for any company or individual working within the IoT space is to understand how the IoT system works as a complete system. A lot of people only think about the individual device, for example, an engineer who has traditionally worked with unconnected machines where there is no need to think about the whole estate, and forgets the fact that an entire eco-system is connected to that one device.

An IoT device is also connected to the company it was developed by and the entire network of similar devices through the applications, databases and reports its data feeds into. So, in just a couple of hops, your house is connected to thousands or millions of others. Each device connection contains potential risk, which is what makes the whole network vulnerable to attackers.

Organizations need to instigate the education of a wider understanding across all employees that one device is linked to an entire community and data constantly going in and out of this community. Understanding the complete system with its applications, databases and reports gives a greater perspective to the different routes and vulnerabilities a hacker could take advantage of.

An engineer must be able to understand the data flow between the device and the eco-system so that they can identify issues, including a breach should it happen. They should be able to understand weaknesses in the system and how devices can be kept updated with patches as they are being serviced. Understanding this bigger picture is vital to mitigating the security risks involved in IoT adoption. 

Furthermore, the public also needs to be made aware of the new risks involved in integrating IoT devices. For example, someone could turn up to the house to allegedly service a smart-meter, but instead access the house and its Wi-Fi and install malware onto the network. This then enables an attacker to steal critical personal data or use systems as part of a botnet.

In recent news, a criminal organization has even hacked cashpoints by installing devices which steal credit card information as it enters the ATM. Of course, it doesn’t have to be malicious, it could be an error by a legitimate installer.

At the simplest level, forgetting to change the default password on the device, through to a compromised laptop which when attached to a home network seeks out other connected devices to install malware on.

While the rise in IoT means our day-to-day is becoming more connected and essentially streamlined, it is vital to educate everyone, from plumbers and engineers to the general public, in the risks involved with adopting increased connectivity and how it can be mitigated.

The government recognizes the need and is putting money into cybersecurity training for services personnel, this needs to be matched by businesses to continue to build trust between consumers and the next generation of connected technology.

Infosecurity:

You Might Also Read:

Internet Of Things Brings Threats To Security

« Darktrace - From Cybersecurity Start-Up To Unicorn
Fraudsters £350k Spoof University Emails »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

RoboForm

RoboForm

RoboForm's industry-leading encryption technology securely stores your passwords, with one Master Password serving as your encryption key.

A-LIGN

A-LIGN

A-LIGN is a technology-enabled security and compliance partner trusted by more than 2,500 global organizations to mitigate cybersecurity risks.

Fraugster

Fraugster

Fraugster provides the most precise anti-fraud solution for e-commerce businesses.

TechBeacon

TechBeacon

TechBeacon.com is a digital hub by and for software engineering, IT and security professionals sharing practical and passionate guidance to real-world challenges.

BotRx

BotRx

BotRx is the only AI-enabled, automated fraud protection technology that allows fast & easy deployment - continually keeping invisible bad bots and agents at bay, so you can rest easy.

Carve Systems

Carve Systems

Carve Systems was founded to bring enterprise level information security, training, and risk management services to organizations of any size and industry.

Synamic Technologies

Synamic Technologies

Synamic Technologies was founded in 2018 as a start-up to automate cyber security processes. Our CISOSCOPE product automates vulnerability management, risk management and compliance.

stackArmor

stackArmor

stackArmor specializes in compliance and security-focused solutions delivered using our Agile Cloud Transformation (ACT) methodology.

SECUINFRA

SECUINFRA

Since 2010, SECUINFRA have specialized in detecting, analyzing and defending against cyber attacks.

Hadrian

Hadrian

Hadrian is modernizing offensive security practices with automation, making them faster and more scalable. Equipped with the hacker’s perspective, companies can now know what their critical risks are.

Nasuni

Nasuni

The Nasuni File Data Platform offers the protection, detection, and recovery of file shares from ransomware attacks or random disasters within minutes.

Cyber-Security Council Germany

Cyber-Security Council Germany

The German Cyber Security Council's objective is to consult businesses, government agencies and political decision-makers and to support them against cybercrime.

PatchAdvisor

PatchAdvisor

PatchAdvisor core services include Vulnerability Assessments/Penetration Testing, Application Vulnerability Assessments, and Incident Response.

AddSecure

AddSecure

AddSecure is a leading European provider of secure IoT connectivity and end-to-end solutions.

Qevlar AI

Qevlar AI

Qevlar AI empowers SOC teams, to eliminate redundant tasks and refocus on what truly matters - making the most of every employee within the SecOps team.

Prophet Security

Prophet Security

Prophet Security empowers organizations to triage, investigate, and respond to alerts with unparalleled speed and accuracy.