What are IoT devices?

The Internet of Things (IoT) is a network of physical items implanted with sensors, software, and other technologies that act on the collected data via machine learning. They are devices created to adapt to users’ daily needs and improve daily repetitive tasks. It can be anything from intelligent kids’ toys or smart home appliances to healthcare devices, vehicles, etc.

However, businesses use IoT technology on a larger scale, starting with smart office systems that include smart locks, remote security cameras, and climate control, and ending with complex solutions, such as digital financial modeling, AI-based management solutions, intelligent factory systems, autonomous agriculture, etc.

How IoT is transforming businesses

Research shows that companies who utilized IoT devices for a year noticed these positive trends: improved productivity, reduced labor, increased worker safety, etc.

Here are a few examples of how IoT improves business solutions:

1. They help you manage and track your inventory by providing various remote control choices.

2. They are becoming smarter with every connection to the device – the more they track, the more they learn about the patterns, and by doing so, they optimize the user’s experience.

3. They innovate businesses with the help of predictive maintenance. For example, these devices will help monitor your harvest if you work in agriculture.

4. They reduce waste by improving power management and water consumption, making businesses more eco-friendly.

5. They reduce human labor by automating repetitive tasks and helping to allocate workforce resources to more complex tasks.

6. They automatically schedule and control various production tasks, increasing productivity.

7. They assist in maintenance. For example, IoT devices measure temperature, humidity, and other indicators to achieve necessary storage conditions.

8. They can even prevent diseases or health issues by tracking necessary health data, such as blood sugar levels, and reminding about insulin injections.

The hidden dangers of IoT

The advantages are outstanding, but many IoT devices still don’t meet the minimum cybersecurity standards. If not secured, they’re sensitive to cyberattacks, such as an incident with a hijacked Tesla when the attackers gained access to car control while it was driving.

The number of cyberattacks on IoT devices is growing at alarming rates. In the first half of 2021, it was twice as high as the total number of attacks in 2020. Here are the most frequent types of threats carried out against IoT devices:

• DoS (denial-of-service) attacks are carried out to take down company online assets and steal their sensitive data.

• Brute-force password attacks lead to criminals gaining access to a particular device.

• Firmware hijacking is used to access a device when software is downloaded from an illegitimate source.

• Eavesdropping attack occurs when a hacker intercepts, deletes or changes data sent between two devices.

Top causes making IoT devices insecure

A recent study addressed the most common IoT security issues: lack of personal information privacy, unprotected software, insecure web, weak passwords, and lack of encryption. In general, many people and businesses don’t prioritize security simply because they are unaware of why they need it. Unlike laptops and other types of consumer electronic hardware, many of these devices don’t have built-in security that provides regular security updates.

Another issue is that people don’t change the initial default settings and leave them as they were after setting up IoT devices at their home or office. Many off-brand IoT producers manufacture devices with fewer resources and cheaper components that usually are insecure, creating an ever-increasing threat to the device owners.

How to secure your business IoTs

The main problem for businesses is that they have too many devices and don’t usually supervise them. That creates security gaps in your cybersecurity and opens the doors for eager cybercriminals. So, here are 10 steps for how you can secure your business IoT devices:

1. Understand the current IoT assets. Run an internal audit to determine how many and what kind of IoT devices you have and who has the access.

2. Monitor ALL the devices. Keep an eye on all of your devices to protect them from being infected – utilize a tech solution to automate this process.

3. Apply a tracking system. Implement an identity and access management (IAM) solution that will allow you to track which IoT devices are active and when they go online and offline.

4. Build an internal security system. Block any potential threat by using network access control (NCA) technologies that authenticate and authorize network users to access your company’s information.

5. Remove all data from old devices. Pay attention to the devices that aren’t in use anymore, as they may store important information. After removing all data, consider returning them to manufacturers for recycling.

6. Choose reliable suppliers. Pay attention to the manufacturer of your IoT devices, because it’s very important to know whether the device comes with built-in security and how you should update it from reliable sources in the future.

7. Keep the devices up-to-date. Various software updates bring bug fixes and security patches, so it’s essential to be updated regularly.

8. Make unlockable passwords. Build strong password combinations consisting of various symbols, letters, and numbers to make them hard to crack. Also, creating a master password would do the trick if the devices are connected to a phone, tablet, or computer.

9. Guarantee IoT security. Ensure that you are using port security, invest in a network intrusion detection system, disable port forwarding, and use security solutions like VPN and firewalls.

10. Secure the Wi-Fi. Last but not least, ensure the Wi-Fi router’s safety – strengthen the router firewall, deactivate WPS, and enable the WPA2 protocol. And, as always, use a strong password for it!

First, could you tell us a bit about yourself and what you do here at Nord Security?

Hey, my name is Aivaras, and I am the Head of Product at NordLocker. I lead the team who provides an encrypted cloud solution for anyone who wants to safely store their data and still be its original owner. I know it sounds similar to what usual cloud providers say, but, believe me, you lose control over your files the moment you upload them to the cloud. The simple truth is that many providers still have the decryption key and can access the files at any time. With NordLocker, it’s the opposite – we secure your data without the ability to see it, a.k.a zero-knowledge architecture. Together with a team of excellent Product Owners and Designers, we successfully lead the product’s vision, roadmap development, and new feature discovery.

Weakest nodes of security in business

From your experience, how likely are companies to protect their data and have a data protection policy in place? Why?

Well, this likelihood usually comes down to several different factors. First of all, it depends on the company size, the industry in which it operates, IT maturity, and more. Secondly, it’s also somewhat affected by the growing awareness of data security risks and the necessity to secure it through various data protection measures. And finally, the most impactful factor is the rising number of breaches and the fear of becoming one of the targets. As a result, companies tend to care more about their data security when they or someone close to them experience a breach. So, it’s still more “reacting to disaster” than preparing for it proactively.

In your opinion, what can cause more security breaches and damage – lack of security policy or employee carelessness? Why?

It is unquestionably both. Businesses that don’t have at least basic security policies in place often become easy prey for cybercriminals. Unfortunately, the same thing can happen due to the employee’s carelessness. A company with the most sophisticated, well-described, and thought-through security procedures can be compromised if employees keep their passwords written on sticky notes on their desks. In that case, no policy can help. Cybercriminals spend a lot of time looking for the weakest links in a company’s protection, and if there are any, it’s bound to be exploited.

Even though people are often a company’s weakest link in security, this doesn’t happen just because they are careless. Usually, our basic habits, knowledge of cyber threats, and understanding of security policies and tools differ, and we aren’t very aware of complex security measures. So to ensure that employees aren’t the cause of a breach, every business should ask itself whether it’s easy for people to use already applied security tools and what additional effort employees have to make to follow those security policies.

The growing scale of ransomware

Let’s talk a little bit about ransomware. How big of a threat to company security is it? Could you share a bit of data on that?

The truth is that nowadays, ransomware is one of the biggest and fastest-growing threats. Mainly because it causes two very harmful things for businesses – it steals sensitive data that can cause reputational damage if exposed and blocks business access to crucial data needed to run daily operations. This fear of disruption and data loss pushes company owners to pay ransoms, increasing the attackers’ desire to carry out even larger operations. In fact, in 2021 alone, ransomware attacks rose to 1,000 per day, mostly targeting industries such as construction, manufacturing, finance, and others. So no business is safe from ransomware and other types of malware unless they do data encryption to protect against these threats.

What is the more attractive target for cybercriminals – confidential business information or employee information?

At the end of an attack, attackers typically seek to gain access to confidential company information, which is the ‘highest tier’ in data value scales. However, this data is usually the most protected from hackers. So, this is where employee information comes into play: breaching employee data can lead attackers further and provide them with access to more important corporate data. Simply put, stealing employees’ information could be the start of a very complex and harmful data breach.

Evaluating the risks

Does the size of a company directly impact the effectiveness of its cybersecurity policy? Why? How should a company solve such a problem?

Well, the company size doesn’t necessarily affect the effectiveness of cybersecurity. Larger companies may seem more resilient to cyber-attacks because they have more resources and a greater number of dedicated IT specialists who can examine the company’s cybersecurity ecosystem. However, this is not the case. They may have much more flaws, and it is far more difficult to oversee the training and safety of thousands of people rather than 10 or 20. On the other hand, small businesses cannot dedicate large budgets to cybersecurity and employ IT security professionals. However, being small, they are less likely to attract the attention of criminals. Nevertheless, there is always a risk. So, no matter how big or small the company is, all businesses should think about potential cybersecurity dangers regularly.

Usually, a ‘what-if’ scenario helps to evaluate the scale of risk:

1. What if your business gets attacked?

2. How difficult would it be to continue business operations?

3. What are the costs of a potential loss of data?

4. What appropriate resources and attention should be dedicated to cybersecurity?

Practical tips to ensure your data is safe

How important is it to encrypt corporate information? How effective are NordLocker’s algorithms used to encrypt the company’s data?

Data encryption is one of the safest ways to protect corporate information from cyberattacks. Even if a file is stolen, the content is encrypted and cannot be accessed by anyone else. And this is where our NordLocker product succeeds – it combines data encryption with secure cloud storage and backup. So, in the event of a ransomware attack, the company’s data is protected and cannot be taken hostage, while the backups provide business continuity.

From your point of view – what steps should a company take to protect its information? What advice would you give to them?

1. First of all, a company should treat cybersecurity as a continuous business activity by making sure they are aware of the latest cyber threats. It is important to keep in mind that there is no one perfect solution or tool that could protect against all threats.

2. The second step is to identify possible dangers and weak areas in your firm. Once you find thems, make sure you implement the best security measures to strengthen your company’s vulnerabilities.

3. Finally, keep in mind that even the most modern security policies and tools may be considered worthless if the company’s employees do not naturally apply them. Using security tools that are simple to deploy and easy to use by employees with different technical knowledge can help make their daily routines much safer.

Thus, it is important to maintain a holistic approach and use a wide range of security tools that are easy to use and do not stand in the user’s way. It will help build a security net over the business and make it more resilient to ever-increasing cyber threats.