IoT devices are anything that connects to the cloud and collects data. It could be locks, garage door openers, temperature monitors (such as Google Nest), refrigerators, security cameras, ovens, televisions, or any other gadget that connects to the cloud. Many of the latest warehouse machinery connects to the cloud. Notice that these devices are not considered mobile devices, which have a standard operating system and their own cybersecurity standards. IoT devices use an operating system, usually Linux, but it’s a modified version of the full software.
Because IoT devices work differently than standard mobile devices, they require their own set of cybersecurity rules unique to the way they operate. They don’t have the advantage of inherent security rules that come with a mobile device such as iOS and Android. When IoT first became popular, several data breaches and disastrous attacks were launched against these devices. Even today, IoT security is still a challenge for many developers and manufacturers.
IoT security involves protecting data as it transfers from the local device to the cloud. It also protects the device itself from being compromised. Because users rarely change the default password for IoT devices, malware named Mirai is a significant threat. Mirai targets IoT devices with the default password still active and running Linux and makes it a part of a botnet. This botnet is then used to launch a distributed denial-of-service (DDoS) against a target. Simply changing the default password and blocking Telnet services will help stop Mirai’s brute-force attack on IoT devices.
Because IoT devices communicate with the cloud, security must also involve protecting transferred data and the location where it’s stored. The cloud stores a myriad of data points that could be used in identity theft or intrusion of the user’s privacy if an attacker can compromise the user’s account. Although many website owners work with SSL/TLS on data transfers, IoT device manufacturers have been found to transfer cloud-connected devices without encryption.
Authentication issues have also plagued IoT security. Most notably is missing authentication or broken authentication found in children’s toys. Data breaches on children’s toys potentially give an attacker access to a toy’s activity and the child’s personal information. Better authentication tools and protection from brute-force password attacks stop attackers from obtaining this information.
There is no one way IoT security works, but it’s been a goal for cybersecurity professionals to educate developers and manufacturers on the proper methods of coding with security and placing better protections on cloud activity. IoT security includes encrypting data travelling in the cloud, better password controls, and coding IoT actions that defend against attacker-controlled scanners and tools. With no accepted standards, IoT security is in the hands of users who own the devices and the manufacturers and developers who release them to the public.
