The “Internet of Things” has changed the way many of us live both at home and in our businesses. The ability to connect devices to the internet wirelessly has simplified the setup process and increased the usability for all kinds of systems but has also created new security challenges businesses and home users should be aware of.
What is the ‘Internet of Things’ (IoT)?
Really, IoT is just a fancy phrase that means “stuff that wasn’t connected to the internet but now is.” For businesses, this could be everything from point of sale (POS) systems, security cameras, lights, and even door locks.
Why is it a security risk?
The unfortunate reality is that every device on a network is a potential foothold for a cyber-attacker. Each device, big or small, is effectively a small, very specialized computer. As a result, insecure devices can be used as an entryway into your network and then can pivot to access other devices on the same network. In cybersecurity we call this “lateral movement.”
How do we protect ourselves?
Protecting yourself in a connected world is critical, especially when it comes to your business. Here are some tips to protect your business while still getting all of the convenience of connected devices.
>> Segment your network. Network segmentation is one of the best things you can do to protect your network.
Network segmentation is when you create smaller “Virtual Networks” (VLANs) in your environment to virtually split up which devices can communicate with each other. A common setup, especially for businesses like a retail store or a coffee shop, might be to build four “virtual networks.”
For example:
1) Network for devices that fall under compliance, like your POS systems.
2) Network for normal business devices, like a desktop computer or a laptop.
3) Network for your customers.
4) Network for all your IoT devices that don’t fall into one of the other categories. This setup stops customers from accessing any of your business systems; it protects your POS systems and your other business devices in case those get compromised.
IoT devices now have their own virtual network to communicate out to the internet but not affect all the other systems if they were to get compromised. Modern network hardware takes this one step further and can do things like “automatic host isolation,” where any device connected to the customer network is put on its own super-segmented network so customer devices can’t talk to other customer devices.
And the best part is that most business-class and even higher-end home devices are capable of this kind of segmentation. You don’t need super-fancy or expensive hardware.
>> Choose a trusted vendor. Amazon and other sites are full of cheap “smart” devices. Many are made by fly-by-night companies that won’t be around long enough to maintain or support their hardware. Use reputable brands that you can trust to both manufacture the hardware and update it in the future. While not all brands make all kinds of devices, limiting the brands you use to a couple of trusted ones also makes management of the devices easier and increases the probability that they can all work together.
>> Opt for an advanced firewall solution. Use a firewall with advanced security features like web/content filtering and built-in malware scanning. This will help prevent customers and your team from mistakenly navigating to malicious websites and help stop already malicious devices from connecting back to their “command and control” servers.
>> Update your devices. I know, this feels like stale advice, but it is still absolutely true.
Many IoT devices automatically update, but lots of them still don’t. I LOVE the convenience of having a “smart home” and a “smart office,” but that means at least once a month I have to spend some time checking in on my devices to ensure the most recent firmware updates are installed — just like I do with my firewall, router, switches, access points and computers. Luckily, with IoT devices, it is often as simple as loading a few apps on a phone or tablet and hitting the update button.
>> Change the default passwords on your devices. If your device has a logon, change the username and password from the default.
By doing the above, you can get all the convenience of having smart devices helping you make your business more customer-friendly and your life easier while also keeping you and your customer data safe and secure.
Jordan Silva is a senior manager of security and cloud services at Hawaiian Telcom. Reach him at jordan.silva@hawaiiantel.com.
