Welcome back to our series on security insights. Today we're talking about the
Internet of Things in the office. As the office of today - and the future - continues
to develop, the tools behind it also develop. So what is IoT in the workplace?
Or rather, what isn't it? What are the advantages and disadvantages? How can we
keep it secure? And who is responsible?
There are three main things that we forget, which are crucial to stay aware
of in order to secure office IoT. We forget how connected we are.
The first thing to get across about office IoT is just how much of it there really is.
It's easy to forget how connected we really are - and need to be - in the office.
Just look around you. How many TVs, printers, laptops do you see? Now look ON you.
What about your phone, your smart watch, your fitness tracker? I even know of someone with a
cochlear implant that's connected, and it's IoT too - the same goes for insulin
pumps and for some kind of pacemakers. Really and truly IoT is everywhere.
It's around you. It could be on you. It can even be in you. In fact, it's fair to say
the office has become infested with IoT - I mean that in a good way and a bad way.
Which brings me on to my second point.
We forget the importance of how connected we are. IoT presents almost as much risk
as it does opportunity. What do I mean by this? The same cyberattacks that
can happen on computers, can also happen on IoT. As what is IoT?
It's just embedded computing. But the problem is, that with IoT, these attacks become even
more pervasive as IoT can be everywhere and anywhere. This is because they're
connected to the network. Once an attacker has hacked one device they may be
able to reach an entire business. Something as seemingly innocuous
as a security camera is now, almost certainly, an IoT device.
If it isn't protected in the same way as your business laptop is, a hacker
need only access that camera and then they may be in your core network or
systems. Ignoring that once they control a camera they can do anything they want.
Turn it on and off, watch your video stream, or reconfigure the entire camera
to act as part of a botnet. Which is essentially what happened in the
Mirai attack in 2016. Scary isn't it?
Video conferencing equipment is a favourite target of some attackers.
Internet-connected - check. Access to external networks - check.
Full of juicy information - check. And Printers - including
things like print management servers. It's the same story. Internet connected,
potentially externally accessible, full of juicy information. People tend to only
print or scan things of importance. These devices are essentially data
accumulators, storing traces of sensitive information, so unless they're properly
configured, they're a risk.
And my last point: we forget WHO is responsible for
office IOT. Everything connected to the office network should be the
responsibility of IT. This means that the IT team need to be responsible for it
and the security team needs to know the data flows and exactly what's going where.
The major problem with office IoT is ownership. It's so easy to connect
devices, they are often not understood and are incorrectly configured. And in
many cases setup with default credentials. IoT is just a computer with
a different name. A printer has a hard drive. A smart watch has internal memory.
A smartphone connects to the cloud. These things are computers!
As an IT professional you would never get a laptop out of its box, power it up and
hand it directly to the user without configuring it! Yet people do that with
IoT all the time, because they haven't fully understood just how much data it
contains and how vulnerable it may be. Realistically, even servers don't get
patched as often as they should, so how often is IoT patched or even properly configured?
So: Own and be responsible for all devices in your network.
Think about patching and secure configuration before you purchase -
ask the manufacturer now. Regularly scan your network for unknown devices and get them
known about. Accept you won't be able to find everything and have a plan as to
what you will do when one of your IoT devices gets hacked.
I'm Quentin Taylor. Stay tuned for more advice and information on security issues
and don't forget to Like and subscribe.