IOT Security

Latest News From Blog

Image IOT Security

IoT Security: What Your Business Needs to Know

The internet of things (IoT) remains a popular subset of the information technology (IT) realm. However, despite its advancements, IoT is still in its infancy. By 2027, the global IoT market is estimated to be worth over $1,463.19 billion USD. With massive leaps in IoT technology and a rapidly changing landscape, IoT security is a budding concern. Here's what you need to know about IoT security.IoT Security Is a Difficult TaskIoT security is tough to implement. A major contributing factor is the complexity of IoT and its many factors. Instead of the back end, there's network security and physical device security to consider as well.The current landscape values ease of use over security. As Manuel Pais points out in DZone's guide to IoT, there's an onus on plug-and-play capability. This prioritizes operability and usability over security.But what's most important for security is testability and configurability. As such, it's necessary to account for testable, configurable software just as much as operable software. Security threats originate from potential DDoS attacks as much as the intentional abuse of hardware and software.What makes IoT security such a tough challenge is that it includes the entire framework from IoT hardware and software to the network.Separate Sci-Fi From RealityArtificial intelligence (AI) is steadily progressing. Still, despite improvements made to the likes of Cortana and Siri, it's nothing similar to Hal 9000 or the T-1000. Similarly, separate reality from fiction to determine the reality of threats posed by IoT security.In 2017, Vizio's smart televisions were found to spy on owners and capture data, which was sold to advertisers. Three years prior, internet-connected fridges were linked to a botnet attack that sent more than 750,000 spam emails.Although there's an increased reliance on interconnected devices, there are steps you can take to protect your business:Digital signatures: From a software perspective, digital signatures provide added security. Digital signatures attached to software ensure they don't run unauthorized programs.Connectivity: Firewalls remain essential in IoT security. A firewall filters protocols to check that network-enabled devices interface properly, and as such, may identify network-based security threats to IoT devices, data, and the network. But within connectivity, there are various protocols used by IoT devices and software; these include Wi-Fi, Bluetooth, NFC, Ethernet, and more.Update selectively: Updates and patches may fix vulnerabilities. A subtle hack threatening users of multimedia software, such as VLC, Kodi, and Stremio, left more than 200 million devices, including many IoT gadgets like Raspberry Pis, vulnerable.Consider the entire infrastructure: IoT isn't merely about the hardware, software, or network. Instead, IoT is its own environment. Consider each component, from the physical hardware and its placement to software to the network. Accounting for IoT systems as a whole insulates you from vulnerabilities.Think about misuse: A 2017 Burger King ad set off users' Google Home AI hubs in what could have been the largest publicity stunt of the year. This follows a 2014 Xbox ad where 'Breaking Bad' actor Aaron Paul accidentally turned on Xbox consoles with a voice prompt.Data security: Data security is arguably the most prominent area of IoT security. All IoT devices gather data, but it's the transfer and recording of the data that presents the threat. Consider how data is transmitted and stored when accounting for data and analytics security in IoT.Internet of Threats: What You Need to Know About IoT SecurityIoT security is a hot topic. But consider real and present threats rather than far-fetched sci-fi scenarios that could inflict a lot of pain and damage to your business. Awareness of IoT connectivity, the complete hardware, software, and network environment, and the latest vulnerabilities goes a long way toward protecting yourself against IoT threats.

Read More
Image IOT Security

INTERNET OF THINGS TESTING

The number of connected devices has rocketed in the past few years and, as Nettitude documented in our 2016 threat intelligence report, the Internet of Things (IoT) has become a significant target for threat actors aiming to build botnets. Such botnets are then often employed to launch some of the largest Distributed Denial of Service (DDoS) attacks ever seen. For example, the Mirai malware discovered in 2016 infected hundreds of thousands of IoT devices and then utilized them to launch high profile, high bandwidth DDoS attacks against high profile websites.Nettitude routinely work closely with the creators of smart devices in order to provide assurance around the security posture of their devices. Internet of Things testing services provide a valuable way to assess the security levels associated with a given connected device.Nettitude has extensive experience in IoT testing and assuring:Smart devices for domestic usageSmart devices for industrial usageSmart meteringConnections for utilitiesSmart devices aimed at the automotive and transport sectorWhen Is IoT Testing Applicable?Nettitude recommend an Internet of Things security test is performed for any device that will be connected to a network under normal use. From cameras to toothbrushes, connected devices are actively being targeted by threat actors aiming to:Serve malicious or illegally obtained softwareCompromise individual and corporate privacyDetails of the motivations and goals for the relevant threatsIn particular, devices that are designed to be ‘plug and play‘ should be subject to an Internet of Things penetration test; their low barrier to setup often means that they are deployed in suboptimal security configurations. For organizations that produce Internet of Things devices and are concerned about their security posture, Nettitude offer a world class penetration testing service.What’s The Output Of An IoT Security Test?Any organization that works with Nettitude on Internet of Things security testing can expect two fully quality-assured reports per engagement. The first is a management report, which is designed to be consumed by a non-technical audience and relays the overall security posture of the target device in terms of risk.The second is a technical report, which provides in-depth technical detail for each finding, including relevant and actionable remedial advice. Of course, the engagement doesn’t stop there. Nettitude always encourage a debrief to ensure full comprehension has been achieved. It’s an opportunity to ask absolutely any questions at all. After the debrief, the organization is welcome to stay in touch with Nettitude and receive top-quality security advice.

Read More