IoT stands for “Internet of Things.” This refers to physical devices that connect wirelessly to a network. The scale of these devices varies between consumer level devices like smart home appliances to Industrial IoT (IIoT) devices that are part of manufacturing processes.

Securing IoT devices is essential for safety, especially with medical IoT and IIoT, but it can be difficult to manage given that they are separate from traditional network monitoring, can come in large numbers from different manufacturers, and may generate large volumes of data.

The goal of IoT devices is to transmit data from the physical world to other devices in order to power applications, services, or process data. For example, a home thermometer will monitor the temperature and transmit this data to another device or cloud environment for visibility, analysis, or management.

While IoT devices can be harmless access points to corporate environments, they can also provide attackers with an initial access point to launch an attack. IoT devices can also be blind spots for many security teams. They can be a critical access point for attackers because of their small size, low signature, and position outside the network, making them a powerful tool to evade traditional security defenses.

If a hacker can breach an IoT device, they may have the opportunity to move laterally throughout a network. Ultimately compromising more critical and important devices.

In complex networks where several operational devices are connected to the internet, protecting IoT is particularly important to ensure physical safety and operational continuity. Vulnerabilities of IoT devices include:

Outdated software

IoT devices that are running on outdated software make it easier for a cyber-attacker to infiltrate through unpatched systems. It is important to ensure that all devices are kept up to date to avoid attacks.

Physical tampering

‍Insider threats and other forms of tampering are possible when protecting IoT devices. In this scenario, someone will gain access to a device by installing malicious or altered hardware.  

Supply chain attacks

IoT devices can lead to supply chain compromises where multiple parties are affected by the attacker. For example,

• If the latest software version on approved company smart watches is compromised, it may put the network at risk if the devices are targeted (and left unpatched)
• If an attacker hijacks a IIoT device at a car manufacturing plant, which eventually leads to the compromise of their car seller partner, who they have some shared sensitive information with  

Weak passwords

‍It is not uncommon for cyber-attackers to attempt brute-force attacks that use computer powered efforts to guess the correct password of a system. Because of this, it is vital to have strong passwords that protect your IoT devices.

Device management

‍Maintaining visibility on the status of each device is vital for protecting its security. Security teams should be aware of all assets and be able to identify potential vulnerabilities within their network and devices.

The following methods can be applied to ensure security of IoT devices:

Take proactive security measures

‍IoT devices enable attackers to potentially have multiple attack vectors as each device represents a potential attack vector. In order to ensure safety of IoT devices, being able to protect against known and unknown threats is vital when selecting a security solution to bolster your security posture.

Complete visibility

‍To protect IoT devices, a security team needs extensive visibility on all IoT devices and any activity taking place between IT and OT systems. Because attackers will attempt to compromise OT in order to move laterally into IT networks, having unified visibility or understanding the live connections between them will greatly increase the likelihood of stopping potential threats.

Incident response

‍In the event of an incident, it is important to be able to trace an attack back to its roots and understand how the event took place in order to stop it from happening again. Having a security system in place that can investigate unusual activity throughout the digital estate and generate readable incident reports will greatly reduce the workload of the security team and help connect the dots to understand an attack.

Speed up detection and response

‍Contemporary cyber-attacks happen at machine speed and once an IoT device is compromised, attackers can move quickly into other networks. Having an automated detection and response system in place will significantly reduce the chances of an attack moving throughout networks.

Implement an air gap

‍An air gap is essentially a ‘digital moat’ where data cannot enter or leave OT environments unless it is transferred manually. While this is a helpful solution to stop cyber-attacks moving from OT to IT environments, it also has its vulnerabilities such as socially engineered attacks, supply chain compromise, insider threats, and misconfiguration.

IoT‍

Refers to appliances or machines that are connected to the internet or a network to perform consumer based tasks. For example, smart air conditioning systems or refrigorators, other home appliances, vehicles, and more.  

IIoT (Industrial Internet of Things)

‍This refers to critical systems such as factory machinery in assembly lines and other critical systems for large organizations that are interconnected to aggregate data.

Read more on Darktrace's blog about how Darktrace's Self-Learning AI is helping stop threats to IoT systems.

IoT security: ‍

The threat before us

Industrial IoT:

Finding pre-existing threats inside Industrial Control Systems

AI neutralizes IoT attack:

Threatening to disrupt the Tokyo Olympics

As legacy devices are retrofitted, technologies such as IIoT are being adopted, and remote working is becoming an increasing practice for industrial environments. Darktrace/OT takes an adaptive approach, with its native ability to learn these changes ‘on the job’ without human input, removing the need for manual configuration and constant tuning.

Rather than relying on pre-defined indicators of compromise (IoCs) and external threat feeds, Darktrace analyzes an ICS ecosystem’s native data through layers of machine learning to detect any unusual behavior, regardless of whether the source is human or machine. This self-learning approach allows Darktrace to detect known and unknown attacks in the same capacity including, but not limited to: zero-day exploits, supply chain attacks, insider threats, ransomware, and devices infected prior to deployment.  

Being protocol and technology agnostic, Darktrace does not need to access specific protocols to perform its threat detection, allowing the AI to identify abnormal activity no matter where it occurs in the digital ecosystem.

‍