The Internet Of "vulnerable" Things?

Today's world is hyperconnected, and organisations are under increasing pressure to collect, collate, analyse and share data in a smart and seamless way. However, smart and secure are often not synonymous with each other.  The Internet of Things (IoT) is becoming an increasingly prominent and important facilitator of hyperconnectivity because it involves connecting computing devices and digital machines to everyday objects.

Today's world is also increasingly volatile and risky, and organisations need to remain constantly vigilant against cyber attacks, particularly in relation to the IoT. One of the key questions for most organisations is therefore, how can we be both hyperconnected and secure?

Hyperconnectivity Versus Security

Cyber security extends to an organisations network infrastructure and beyond. Industrial control systems (ICS) are an integral part of the operational technology of an organisation, and work alongside an organisation's IT network and any IoT devices.

As IoT devices become more prevalent, cyber attacks are increasingly directed at ICS or other similar systems in an attempt to compromise an organisations wider network. A targeted attack through an organisations network may have far reaching impacts beyond the walls of its own facilities, e.g. power outages, major health and safety risks, a communication shutdown preventing an emergency response, and preventing the supply of clean water.

Are IoT Devices The Weakest Link?

The recent British government Cyber Security Breaches Survey highlighted that almost all organisations have some form of digital exposure, and that network-connected devices were more common amongst businesses than last year. Ericsson has also predicted that connected IoT devices will consist of around 29 billion by the end of this year.

However, the increasing reliance on IoT devices does not mirror the surrounding security aspects, which are receiving less focus.

In many organisations IoT devices will be embedded into the processing of data which is sensitive and critical to the organisation and its infrastructure. If the lack of focus on security measures continues, the IoT devices, and as a result the data they process and the networks of which they form part, will become increasingly vulnerable to cyber attacks.

Should Regulators Intervene?

The UK Government has recognised at a consumer level that there is a need for minimum security standards for IoT products being sold, with the Queen's Speech announcing that new laws will also aim to impose obligations throughout the supply chain. However, the UK Government has not gone so far as imposing minimum security standards on the industrial IoT or other interconnected systems within an organisation. This seems strange, because organisations usually present a more diverse threat profile than consumers, and r organisations also typically have more knowledge, responsibility and control of networks and cyber security.

In the absence of a minimum standard, Chief Technology Officers and boards should consider how to build and invest in a "security-by-design" mindset within their organisation, and how to future proof any IoT, ICS or other devices through monitoring and maintenance.

Doing so will not only strengthen an organisation's security arrangements, it is also likely to extend the period during which IoT devices can be used, and therefore potentially decrease expenditure on new hardware. 
This may be an uphill battle for some organisations – the Cyber Security Breaches Survey noted that 44% of businesses in the UK see cyber security as only a "fairly high" priority. The DCMS have further found from the survey that there is a lack of understanding of what constitutes cyber risk management, compounded by a lack of expertise and perceived complexity of cyber security matters at a board level.

Organisations are buried under a growing mountain of information, and leaders are struggling to find the right balance between enforcing compliance, providing flexibility to encourage innovation, and giving employees access to the right information at the right time.

What Can Be Done?

Organisations should take a holistic and proactive approach to their cyber security. Research demonstrates that most tend to take a reactive approach rather than being proactive in recognising the strategic risks that may impact the organisation. 

Whilst it may be difficult to do so in the short-term, organisations should try to view investment in cyber security in a more positive light. They should view the investment as a business enabler, not just an extra cost.

Even after such a change in perspective, negotiating sufficient budget for cyber security against other competing priorities can still seem like a battle. This is often a particularly difficult issue where organisations do not outsource IT or other security solutions. This leaves the organisation heavily reliant on an often small group of its own employees, and those employees often don't have a voice loud enough to influence the board and Executive team, or to communicate the importance of cyber security across middle management.

For example, penetration testing of existing systems, or adding a further level of requirements or assurance as part of supply chain due diligence, will pay dividends in the future, but many of an organisation's senior leaders may not recognise that. 

An organisation should look to develop appropriate policies and train employees on recognising risks and being proactive. This should be communicated to a range of different audiences, in order for employees to understand a risk even when they have little or no relevant technical expertise. Any risk mitigation plans put in place by an organisation must include the risks posed by ICS and other IoT devices.. Such plans must cover as much ground as possible, from recognising the early signs of an attack or a breach, through to putting in place a formalised incident management plan.

The risks of supply chain cyber attacks remain high and changing perspectives and culture will not happen overnight. Despite the challenges, it remains essential that an organisation is able to detect and mitigate cyber risks quickly, in order to prevent the risks crystallising into operational disruption

Sarah Daun and Caroline Churchill are Partners at law firm Womble Bond Dickinson

You Might Also Read: 

EU Businesses Risk Fines For Not Complying With IoT Security Rules:

 

« Privileged & Protected - Managing Access At The Endpoint
The Role of Zero Trust Architecture In Minimising Cyber Risks »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Resecurity

Resecurity

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

Brookings Institution

Brookings Institution

The Brookings Institution is a nonprofit public policy organization. Cyber security is covered within the various study areas.

CS Group

CS Group

CS Group offers a complete range of security solutions from consultancy to security maintenance and from secure infrastructure design to security governance.

NordForsk

NordForsk

NordForsk facilitates and provides funding for Nordic research cooperation and research infrastructure. Project areas include digitalisation and digital security.

Samsung Knox

Samsung Knox

Samsung Knox brings multi-layered defence-grade security to your business’s smartphones and tablets.

VerifyMe

VerifyMe

VerifyMe is a global technology solutions company delivering brand protection offerings to mitigate counterfeiting, product diversion, and illicit trade.

NetGuardians

NetGuardians

NetGuardians is a leading Fintech company recognized for its unique approach to fraud and risk assurance solutions.

CryptoSec.info

CryptoSec.info

CryptoSec.info is a web resource focused on educating the beginners in the cryptocurrency space on how to properly secure their online assets from hackers and scammers.

CYDES

CYDES

CYDES is the first event in Malaysia to showcase advanced solutions and technologies to address cyber defence and cyber security challenges for the public and private sectors.

spriteCloud

spriteCloud

spriteCloud is an independent software testing, test automation and cybersecurity services provider.

LogicHub

LogicHub

LogicHub is built on the principle that every decision process for threat detection and response can and should be automated.

VectorRock

VectorRock

Save Your Business From Cyber Criminals. We specialize in uncovering cyber risks which threaten your organization and fixing them.

Ekco

Ekco

Ekco is one of Europe’s leading managed cloud providers. With a network of infrastructure and security specialists across Europe, we’ve perfected our approach to supporting digital transformation.

National Cyber Security Agency (NCSA) - Thailand

National Cyber Security Agency (NCSA) - Thailand

National Cyber Security Agency of Thailand is responsible for coordinating and implementing national cybersecurity policies, strategies, and initiatives.

Digital.ai

Digital.ai

Digital.ai empowers organizations to scale software development teams, continuously deliver software with greater quality and security.

Cyber Industrial Networks

Cyber Industrial Networks

Cyber Industrial Networks objective is to service the needs of industry in achieving reliable, robust and secure infrastructure that supports productivity.

LetsData

LetsData

LetsData uses AI to provide governments, intergovernmental organizations, civil society, and businesses with data-empowered decisions on communication in the age of online disinformation.