Mitigating IoT Cyber Risks: Training Is The First Step

The Internet of Things (IoT) is increasingly becoming an integral part of our everyday lives. From fridges to watches to Alexa virtual assistants and the cars we drive, more and more households are introducing IoT devices into their daily routines.

In fact, it’s projected that the number of IoT devices will reach 125 billion by 2030. However, while the concept of a truly connected lifestyle is an exciting one, it also introduces a number of new risks.

Recent news that plumbers are receiving cybersecurity training due to an increase in smart heating devices further highlights that cybersecurity is broadening its reach into various trades because of IoT. Roles which five years ago we would never have thought of as requiring cybersecurity training, will need it as adoption of connected devices for business continues to rise.

As homes become more connected, the tradespeople who install and service IoT devices need to be more aware of the cyber risks associated with them, particularly when they involve personal information.

Many of the smart devices being used within the home currently lack basic cybersecurity provisions, which could lead to the theft of personal data and the intrusion of private spaces and networks. Security is needed to protect IoT integrity and to reduce the risk that it may be used for hostile purposes, so there is a real necessity to educate people who work closely with IoT devices around how to detect and deal with a security issue.

That is not to say that the rise of IoT adoption, both in a consumer and industry sense, is not a positive. Introducing a more connected world means an increase in productivity and efficiency, with companies being able to analyze the data from a device – whether that is a smart meter, boiler or even lights – and respond to customer issues much quicker.

But realizing the potential of these connected devices should be considered alongside the introduction of robust security measures.

Most importantly, for any company or individual working within the IoT space is to understand how the IoT system works as a complete system. A lot of people only think about the individual device, for example, an engineer who has traditionally worked with unconnected machines where there is no need to think about the whole estate, and forgets the fact that an entire eco-system is connected to that one device.

An IoT device is also connected to the company it was developed by and the entire network of similar devices through the applications, databases and reports its data feeds into. So, in just a couple of hops, your house is connected to thousands or millions of others. Each device connection contains potential risk, which is what makes the whole network vulnerable to attackers.

Organizations need to instigate the education of a wider understanding across all employees that one device is linked to an entire community and data constantly going in and out of this community. Understanding the complete system with its applications, databases and reports gives a greater perspective to the different routes and vulnerabilities a hacker could take advantage of.

An engineer must be able to understand the data flow between the device and the eco-system so that they can identify issues, including a breach should it happen. They should be able to understand weaknesses in the system and how devices can be kept updated with patches as they are being serviced. Understanding this bigger picture is vital to mitigating the security risks involved in IoT adoption. 

Furthermore, the public also needs to be made aware of the new risks involved in integrating IoT devices. For example, someone could turn up to the house to allegedly service a smart-meter, but instead access the house and its Wi-Fi and install malware onto the network. This then enables an attacker to steal critical personal data or use systems as part of a botnet.

In recent news, a criminal organization has even hacked cashpoints by installing devices which steal credit card information as it enters the ATM. Of course, it doesn’t have to be malicious, it could be an error by a legitimate installer.

At the simplest level, forgetting to change the default password on the device, through to a compromised laptop which when attached to a home network seeks out other connected devices to install malware on.

While the rise in IoT means our day-to-day is becoming more connected and essentially streamlined, it is vital to educate everyone, from plumbers and engineers to the general public, in the risks involved with adopting increased connectivity and how it can be mitigated.

The government recognizes the need and is putting money into cybersecurity training for services personnel, this needs to be matched by businesses to continue to build trust between consumers and the next generation of connected technology.

Infosecurity:

You Might Also Read:

Internet Of Things Brings Threats To Security

« Darktrace - From Cybersecurity Start-Up To Unicorn
Fraudsters £350k Spoof University Emails »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall And Why Does It Matter

See how to use next-generation firewalls (NGFWs) and how they boost your security posture.

Axiomatics

Axiomatics

Axiomatics provides dynamic authorization and access control solutions to protect critical data assets.

Code Dx

Code Dx

Code Dx is a software application vulnerability correlation and management system.

Casaba Security

Casaba Security

Casaba are specialists in software security providing managed Software Development Lifecycle services as well as products for security testing.

IS Decisions

IS Decisions

IS Decisions builds affordable and easy-to-use Access Management software solutions, allowing IT teams to effectively secure access to Active Directory infrastructures, SaaS apps and data within.

CERT-PA

CERT-PA

CERT-PA is the national Computer Emergency Response Team for Italian government institutions.

Cobalt Strike

Cobalt Strike

Cobalt Strike is penetration testing software designed to execute targeted attacks.

London Office for Rapid Cybersecurity Advancement (LORCA)

London Office for Rapid Cybersecurity Advancement (LORCA)

LORCA's mission is to support the most promising cyber security innovators in growing solutions to meet the most pressing industry challenges and build the UK’s international cyber security profile.

Cybersecurity & Infrastructure Security Agency (CISA)

Cybersecurity & Infrastructure Security Agency (CISA)

CISA leads the national effort to defend critical infrastructure against the threats of today and to secure against the evolving risks of tomorrow.

Maticmind

Maticmind

Maticmind is an ICT System Integrator providing solutions and specialized skills in Networking, Security, Unified Communications & Collaboration, Datacenter & Cloud and Application.

certSIGN

certSIGN

certSIGN develop innovative software for information security and information systems protection.

Irish National Accreditation Board (INAB)

Irish National Accreditation Board (INAB)

INAB is the national accreditation body for Ireland. The directory of members provides details of organisations offering certification services for ISO 27001.

Rizikon Assurance

Rizikon Assurance

Rizikon Assurance is an Online System that improves Third-Party Assurance and Risk Management, through efficiency, automation and better visibility.

Omnipotech

Omnipotech

Omnipotech is a complete managed service provider. From desktop to datacenter, all the technology support you need, under one umbrella.

Littlefish

Littlefish

Littlefish provide world-class, award-winning Managed IT and Cyber Security Services, delivered from our 24/7 UK service centres.

Nine23

Nine23

Nine23 are a highly focused cyber security solutions company that defines, builds and manages innovative services, enabling end-users to use technology securely in today’s workplace.

HTX (Home Team Science & Technology Agency)

HTX (Home Team Science & Technology Agency)

HTX brings together science and engineering capabilities to transform the homeland security landscape and keep Singapore safe.