The spread of the “Internet of Things” is a growing trend with a wide range of different objects, sensors, and devices connected to the Internet.
It has been predicted that by 2025 there will be nearly 75 billion connected IoT devices in the world.
This exorbitant number of “objects,” often referred to as “smart” to indicate their digitally extended capabilities, while they bring significant benefits, also expose to numerous risks.
The main threat comes from the perception of these devices, which in general conception are merely “things,” with the same level of trust reserved for everyday household appliances.
We certainly do not expect to suffer a cyber attack from the smart TV at home!
On the contrary, being networked, these objects should be considered in the same way as computers, especially in terms of the cyber risks they pose.
Every networked device, in fact, can potentially be compromised.
A cyber attack on an IoT device, therefore, is by no means a remote possibility; in fact, nowadays it is a relatively common occurrence.
Cyber Risks related to IoT
IoT devices often originate as ordinary objects, sometimes very small in size, which are later adapted to be networked in the most convenient way possible.
The result is that concerns related to cybersecurity are rarely considered in the design phase, exposing not only the devices themselves, but also all systems and information that will be found in the same network, to significant threats.
The risks increase the more critical the scope of IoT is, such as in the industrial sector (we refer to these to IIoT, Industrial Internet of Things), hospitals, the energy sector, etc.
Sometimes, IoT come with an included maintenance service that is fully managed by the vendor. This, while it may seemingly simplify the situation, prevents the user from having full control over the management of the devices and verifying that the measures put in place are adequate.
In general, IoT cyber risks can be divided into three categories, which are examined below:
- Perception risks: IoT devices are generally viewed as mere objects and not as networked elements that should be protected in the same way as computers and smartphones. This situation generates a wrong assessment of risks as they are not perceived as potential attack vectors. Instead, any incidents could not only compromise their functions but also allow access to other systems on the same network. Cyber risks in this case are totally ignored, due to a form of excessive trust, and it is good to reiterate that every networked device is potentially at risk and should be properly protected.
- Connection risks: IoTs can connect to the Internet or other devices in a variety of ways: Ethernet (via the common network cable), Wi-Fi or other protocols such as Bluetooth are all viable options that are chosen based on the nature of the device, convenience or technical needs. It would be good for devices to adopt secure, state-of-the-art connection methods, as well as Internet data transmission systems that can protect the privacy of their users (e.g., through the use of VPNs or by encrypting data before transmitting it). But users do not always have sufficient control over the type of connection or configuration of IoTs, as these decisions are made at the design stage and the interfaces do not necessarily allow for alternatives. It can prove difficult, therefore, to even verify the security of the protocols used, not just change their configuration. The connections of these devices may also be affected by additional issues such as absent or insufficiently robust authentication, lack of verification and access control, or lack of network segmentation. These issues expose not only IoTs but also everything on the same network to the risk of compromise.
- Application risks: IoT devices are designed with operating systems and firmware that are subject to vulnerabilities like all software. While in the case of conventional IT systems, processes for checking and managing updates are now a well-established practice, in the case of IoTs on the other hand, applying security updates and patches to software, firmware and related systems can be difficult, when not impossible because they are not provided for by the user interface. Even where the update is expected, the misperception of these devices does not facilitate the process. For example, it may not occur to us to periodically check for updates for our home smart TV or smart thermostat, even though we are aware of how important this check is for the computers and applications we frequently use.
Conclusion
The mass adoption and use of IoT devices brings many security benefits, however, the significant cyber threat that is also introduced often goes unconsidered. As we introduce more “smart” devices into our daily routines, we need to realize that these are no longer just normal home appliances, but potential threats to our networks.
Therefore, in order to mitigate IoT cyber risks, it is important to consider these devices with the same level of security as computers and to increase vigilance as the IoT phenomenon continues to grow.
Stay Cyber Safe!
