Aug 09

2018

IoT security is not A-OK

By Neil Cook, Chief Security Architect at Open-Xchange

Everyone knows that the internet can be a dangerous place. Phishing continues to increase in volume and effectiveness, affecting everybody from private users to internet giants like Google and Facebook. Meanwhile, the rise in ransomware attacks has made malware particularly costly - with some insurers estimating up to $4 billion in losses from 2017’s WannaCry attack alone.

As phishing and malware attacks grow more and more sophisticated, so do the systems designed to protect users from such attacks. Consequently, users are becoming more familiar with the various security systems designed to protect their laptops and personal computers. But what about smart devices?

In 2017 the total number of IoT devices reached 8.4 billion - a number higher than the population of Earth. And by 2020, this number is anticipated to hit 20 billion. Without effective malware-protection, each one of these devices is a potential opening through which cybercriminals could launch a devastating attack. This isn’t just hypothetical - IoT attacks have already occurred, and they’ve hit a broad spectrum of smart devices, from pacemakers and cars to traffic lights and toys.

So why not build protection into each IoT device as a standard? Well, there are a couple of reasons. Firstly, integrating security protection would increase the price of each device significantly; and secondly, there often isn’t enough CPU or RAM available to support on-device malware protection. Also, many such devices don’t even have a mechanism to provide or download security updates.

The only real solution lies with network-based detection, where a layer of protection is provided by the network that all the IoT devices in a household connect to. This would allow an administrator to detect threats to any device on its network, while proactively preventing such devices from connecting to malicious websites.

Network security does currently exist in the market, but it is generally restricted to external hardware. Unfortunately, these boxes usually come with expensive initial costs and subscriptions, as well as restrictions on the amount of devices they can protect. And what happens if the box is broken? Or just unplugged?

Another option would be to enable security at the source of the network: your broadband provider. This way, users are always guaranteed the latest protection for all the devices connected to the network. The cost for this service could simply be added to the user’s existing monthly bill, or even included in package deals offered by the provider. Although the likes of BT, Sky and TalkTalk have started to incorporate this into their offering, all providers need to step to the mark.

On-device security is impractical and hardware security is often hard to maintain and expensive: the answer is network security, directly from your broadband provider. We’ll be telling you more about our security solutions as we head towards the OX Summit in Rome in September! 

Back to Overview

About the Author

Share this article

Loading