The Internet of Things is still vulnerable in 2019

Source: Hillstone
Networks. Liu.

The 'wild west' nature of the Internet of Things (IoT), coupled with the potential prize of more sensitive information, is likely to draw cybercriminals like a magnet.

Tim Liu, CTO, Hillstone Networks summarised the situation. “Traditionally, security in the IoT space has been lacking due to various reasons such as the myriad of vendors and proprietary protocols. This includes lack of security awareness and focus, as well as the lack of end user interaction with the devices – all of which result in fewer chances of detecting possible breaches,” he said.

“We have seen specific security solutions that target segments of the IoT market, such as security for smart cars and camera networks. This market will grow in 2019. Elsewhere, we will see IoT adoption enterprise-wide in the next few years; compliance requirements and data protection requirements will drive IoT security in those areas.”

Source: Malwarebytes.
Hurmuses.

The attacks will come thick and fast for the Internet of Things (IoT) because there is easy money to be made, said Malwarebytes. Jeff Hurmuses, Area VP and MD, Asia Pacific, Malwarebytes said, “Over the next few years we will see how threat actors turn their efforts to businesses and networks with thousands of end points, to generate a greater return on investment (ROI).”

One of the likeliest scenarios is hijacking IoT devices for cryptomining, ESET said. According to the security firm, an increase in the adoption of cryptocurrencies, as well as a rise in the number of devices connected to the Internet, is the perfect recipe for attackers to build cryptomining farms with smart devices and home assistants as their entry point for 2019.

“Cyberattacks specifically designed to attack IoT devices, such as automated scripts that exploit vulnerabilities in connected devices or processes that are designed to take control of them, will become more frequent,” the company predicted.

Source: Symantec. Trilling.

5G expands IoT attack surface

With 5G, the already large attack surface afforded by the IoT will soon become much larger. Hugh Thompson, Symantec CTO and Steve Trilling, Senior VP and GM Security Analytics and Research at Symantec noted that an expected rapid adoption of 5G “will catalyse new operational models, new architectures, and consequently, new vulnerabilities”.

“Over time, more 5G IoT devices will connect directly to the 5G network rather than via a Wi-Fi router. This trend will make those devices more vulnerable to direct attack. For home users, it will also make it more difficult to monitor all IoT devices since they bypass a central router. More broadly, the ability to back-up or transmit massive volumes of data easily to cloud-based storage will give attackers rich new targets to breach,” they said.

Source: Juniper Networks.
Pitt.

Laurence Pitt, Global Security Strategy Director, Juniper Networks and Mounir Hahad, Head of Juniper Threat Labs, Juniper Networks, also identified the vulnerabilities that 5G brings. “Regardless of the purpose of the device, any device connected to 5G has the potential to become a target for hackers – even if it runs on a secured 5G network, it is still a wireless device and therefore available as a target for a breach. The growth of 5G means that the industry needs to be considering how to have an effective security posture and a solid foundation of security before these new networks are deployed,” they warned.

Data in transit at risk

In addition to being used for denial of service attacks, Thompson and Trilling said the data passing through home routers and other IoT hubs will be of interest to cybercriminals. “Malware inserted into such a router could, for example, steal banking credentials, capture credit card numbers, or display spoofed, malicious web pages to the user to compromise confidential information. Such sensitive data tends to be better secured when it is at rest today.

“For example, e-commerce merchants do not store credit card CVV numbers, making it more difficult for attackers to steal credit cards from e-commerce databases. Attackers will undoubtedly continue to evolve their techniques to steal consumer data when it is in transit,” they said.

Source: Synopsys.
Jarva.

Cities under attack

Several vendors noted that cybercriminals are now targeting critical infrastructure as well.

In Trend Micro's Mapping the Future: Dealing with Pervasive and Persistent Threats report, the company predicts that countries learning and exercising their cyber capabilities will conduct attacks against smaller players’ critical infrastructure. “They will do so to gain political or military advantage, or to test out capabilities against countries that do not yet have the capacity to retaliate,” explained Nilesh Jain, VP, SEA and India, Trend Micro.

Said Andrew Tsonchev, Director, Darktrace Industrial: "As cyberthreats become faster and more sophisticated, and with increased interconnectivity in organisations, traditional defenses that surround critical infrastructure are failing to keep out modern attackers. Rather than stealing data to make a quick buck, hackers can leverage on technology in interconnected environments to turn off the lights, disrupt transport systems, and ultimately threaten public safety.

Source: Darktrace. Tsonchev.

"As geopolitical tensions begin to be played out in cyberspace, nation states will continue to be on high alert [in 2019] to protect their energy grids, manufacturing plants and airports from cyberattack."

Hackers who have traditionally targeted IT systems, are now starting to attack operational infrastructure of companies. According to a recent study by Cisco, 30% companies across Asia-Pacific, Japan and China have already had an attack on their operational infrastructure, while 50% expect such an attack to take place in the future. This has huge implications for companies,” said Stephen Dane, MD, Global Security Sales Organization, APJC, Cisco.

“To be able to better protect themselves, companies need to ensure that their security posture has three key elements; visibility, segmentation and threat protection.

Source: Cisco. Dane.

"The first enables them to see everything with complete visibility of users, devices, networks, applications, workloads and processes. The second reduces the attack surface by preventing attackers from moving laterally east-west within a network even if they break in via a weak link. The last helps to stop the breach by quickly detecting, blocking and responding to attacks before hackers can disrupt operations.”

Data integrity under attack

Cybercriminals could also disrupt things by undermining the public’s trust in the digital data held by the organisations it depends on. "They will do this by, instead of simply exfiltrating data, subtly changing it. These attacks would be stealthy, like a piece of code that turns on for 15 seconds a month and alters various data points,” Tsonchev said.

"It would take weeks or months for an organisation to identify that, if they did at all, at which point all the actions that depend on the initial data being correct would be similarly spoiled. Should this happen in a critical sector, like blood type data in hospitals, the consequences would be to undermine the public’s trust in its nation’s competency to provide dependable services."

“In the Asia Pacific region (APAC), many countries are moving forward with smart city and Smart Nation initiatives. This opens the opportunities for a new wave of IoT cyberattacks. Attacks could be approached from a data poisoning perspective in which faulty information is intended to influence organisational decision making through the sensors deployed within the target city or nationwide,” agreed Olli Jarva, Managing Consultant at Synopsys.

Source: Symantec.
Thompson.

Thompson and Trilling said poorly-secured IoT devices will continue to be used to create denial of service attacks, as well as for other harmful purposes. “Among the most troubling will be attacks against IoT devices that bridge the digital and physical worlds. Some of these IoT-enabled objects are kinetic, such as cars and other vehicles, while others control critical systems.

"We expect to see growing numbers of attacks against IoT devices that control critical infrastructure such as power distribution and communications networks. And as home-based IoT devices become more ubiquitous, there will likely be future attempts to weaponise them,” they said.

Beware of IoT at home

Enterprises will also be attacked via employees’ Internet-connected home devices, said Jain. “We will see a few targeted attack scenarios in 2019 that will make use of smart speaker weaknesses to access enterprise networks through employees’ home networks,” he predicted.

Source: Trend Micro.
Jain. 

McAfee experts think mobile malware will be how cyberattacks will be mounted on home devices. “New mobile malware will likely investigate smartphones, tablets, and routers to gain access to the digital assistants and home IoT devices they control. Once infected, these devices can serve as a picklock to consumer homes while supplying botnets, which can launch DDoS attacks or grant cybercriminal access to personal data and the opportunity for other malicious activities such as opening doors and connecting to control servers,” said thought leaders from McAfee Labs, McAfee Advanced Threat Research, and members of McAfee’s Office of the CTO.

IT/OT convergence

Source: Fortinet.
Newton.

Peter Newton, Senior Director of Product Marketing, Fortinet, said that the results of a commissioned study conducted by Forrester Consulting on behalf of Fortinet in January 2018 had been illuminating when it comes to converging operating technology (OT) and information technology (IT).

"What we learned is that nearly all companies have already begun at least a basic convergence of OT and IT. As these organisations begin to actively converge these environments, however, they are encountering issues related to integration and security that they may not be equipped to handle. IT teams have a tendency to just want to throw security technology at the network and call it good. But these networks can be very different, and what works well in one environment can have devastating consequences in the other," he said.

"Changing out that technology may not be as simple as it sounds and every minute of down time costs money. But at the same time, there are increasing business cases to be made to tie these systems to the larger network...But that means connecting these systems to an open IT environments, thereby exposing that portion of your organisation to new forms of cyberattack it was never designed to detect and defend against."

The issue is magnified when 56% of organisations outsource at least some part of their SCADA/ICS* infrastructure and security, and grant outside parties complete or high-level access. "This is also why over three-fourths of respondents plan to increase SCADA/ICS security spending in the next year more than in other areas," Newton added.

“The first place to start is by choosing a security vendor that specifically addresses the cybersecurity, safety, and reliability challenges being faced by the OT industry. Not all security solutions are the same, especially when it comes to securing OT. You need a vendor that offers a full range of specialized tools and protocols designed for OT environments, and that has established strategic partnerships with the industry’s leading OT security specialists. And these solutions need to be field tested and proven. Unlike IT environments, OT systems and devices cannot afford to be taken offline by an inappropriate security solution,” recommended Newton.

He also said that OT security solutions must be easily integrated into a central security platlform that spans the larger network, and also flexible enough to accommodate solutions from many other partners.

Tsonchev stressed that action is needed to prevent attacks from doing harm once discovered. "Organisations need to shift their focus from post-breach response to early detection, which will generate a far more positive outcome for their organisation and their stakeholders," he said.

"The only way to combat stealthy attacks will be for organisations to embrace new technologies, like artificial intelligence (AI). AI that detects and responds to emerging dangers wherever it originates, will enable organisations to regain control of their networks and prevent early-stage threats from escalating into full-blown crises."

Explore:

Browse the full list of 2018 round-ups and 2019 predictions in TechTrade Asia

DigiCert found that companies struggling with IoT implementations could lose US$34 million or more from IoT-related security breaches.

Read the Keysight 2018 State of 5G report (PDF)

*SCADA/ICS stands for supervisory control and data acquisition/industrial control systems, part of the OT side of the equation.