User Review
( votes)
IoT Risks – Forescout research found the Internet of things (IoT), Operational Technology (OT), and IT devices and systems within physical control access systems posed the most significant risks to organizations. Elevated IoT risks under these deployments are because IoT enabled devices could be targeted to grant entry into the corporate network or bypass physical authorization mechanisms via HVAC tampering. An example is when a casino was hacked through a thermometer in a fish tank. Similarly, people were locked out of their hotel rooms until a ransom was paid in Austria. The research analyzed 8 million devices deployed at 506 locations across the world. Forescout analyzed risk components across various industries such as financial services, healthcare, government, manufacturing, and retail. IoT devices in healthcare verticals, such the pneumatic tube systems, were the riskiest categories.
IoT risks components across deployments
IoT risks were higher across various industrial verticals because IoT devices are more common in these organizations and are more challenging to monitor and control. IoT devices could serve as entry points and final targets of malware attacks. They are also ubiquitous, thus bridging the distance between physical and virtual access.
IoT devices checked into almost all the risk components investigated by the researchers. The researchers analyzed security vulnerabilities, security events, services, connectivity, vendor, and potential impacts risk components of devices across various industry verticals.
Under potential impact, higher IoT risks were associated with the fact that most IoT and OT devices are unmanaged by most security solutions available. The connectivity risk component increased potential IoT risks because of the ability of IoT devices to communicate directly with other devices.
Regarding services, the IoT risks were present because of the various interfaces available on such devices. For example, most IoT devices have Wi-Fi and Bluetooth interfaces that increase the attack surface.
Embedded firmware also increased IoT risks because of the lack of uniformity in the vendor supply chain as well as lack of maturity in most IoT device firmware. Embedded firmware was also associated with increased IoT risks because it is responsible for most backdoors introduced by rogue vendors, hackers, and government entities.
