The Internet of Things (IoT) has revolutionized the way we live, work, and communicate. As the numbers of IoT devices continue to skyrocket, a recent report addresses just how many devices an individual and organizations can comfortably keep secure. As IoT devices surpass this security critical mass, the ramifications are bleak. It is now a necessity for even smaller-scale businesses to actively manage their IoT attack surface, alongside mitigating IoT threats via a DDoS protection service.
From Cold Drinks to Cold Cash: The Growth of IoT
As a concept, the Internet of Things wasn’t named until 1999. However, even from the early 1980s, programmers saw the potential for small pieces of configurable communication technologies. One of the earliest examples of IoT was achieved by students at Carnegie Mellon University. Students, faced with the prospect of a potentially empty Coca Cola vending machine, created a device that would save them from making the hundred-meter trek. By adding a small sensor to the inside of the ending machine, programmers could connect to the appliance over the Internet, check to see if there was a drink available – and even determine if it was cold – before making the trip to purchase one.
The programmer’s device, here, acted as a collection point for the data being sent and collected over the internet. Today, IoT devices facilitate data collection, storage, and decision making; they streamline pattern and routine recognition, and ultimately reduce the requirements for manual labor. However, the lion’s share of IoT connectivity wouldn’t come about until 2002. The introduction of the cloud suddenly enabled immense economic growth, as on-site infrastructure was rapidly rendered optional. Storage, processing, and analytics were now possible on-budget and off-premises. An emphasis on cross-device compatibility soon arose, and the industrial adoption of IoT devices began at pace.
From mobile phones to building maintenance, the simple IoT device started multiplying rapidly: medical devices, dependent upon the swift transfer of biomedical information, saw a revolution in heart implant monitors and biochips. In 2012, The Swiss Federal Office of Energy started a world-first program for smart cities. This facilitated real-time traffic statistics; air quality monitoring; efficient traffic light management; and the introduction of adaptive lighting and heating systems in government buildings. Self-driving cars are not only IoT devices, but also rely on a smorgasbord of on-board controls to respond to adjacent vehicles, log traffic data, and communicate map and weather data conditions to the passenger.
The rise of IoT has streamlined people’s lives, simplified data collection and delivery, and made billions. The enterprise IoT market is now worth $157.billion. This is predicted to grow at a CAGR of 22%, reaching $525 billion in 2027. The global number of online IoT devices is now expected to reach 14.5 billion by the end of 2023.
The Unsecure Underbelly of IoT
In 2020, most U.S. households relied on an interconnected web of 10 IoT devices. This places most households over the threshold of a complex IoT environment. An environment at this scale is almost impossible for individuals to adequately oversee and control thanks to the rapidly-scaling numbers of interconnected functions. An overlooked misconfiguration – incredibly easy to manually overlook – can have dire consequences, potentially even putting physical security at risk.
The ease of access for many IoT devices means that, in the past six years, botnets have exploded in quantity, destructive potential, and variety. Botnets are sustained by poor security, and the high numbers of IoT devices that each individual can own places organizations’ and individuals’ cybersecurity at a statistical disadvantage. Brute-forcing access to these devices becomes trivial when most of them still have their default usernames and passwords.
The security implications of IoT have been ruthlessly exploited since 2016. The Mirai botnet was a major manifestation of this, as it rapidly took down major webpages in a global DDoS attack. The Mirai botnet is exclusively made up of IoT devices; it even has an automatic function that seeks more vulnerable devices to swell its ranks. First, what an infected device does is scan IP addresses, in hopes of identifying smart devices that are running a version of Linux by the name of ARC. After that, Mirai takes advantage of security vulnerabilities within ARC to achieve network access through a default username and various password combinations. In the event that these settings haven’t been updated, what Mirai can do is simply log into the device, gain control, and infect it with malware.
Even bleaker, IoT malware has had years to develop since Mirai. The Torri botnet is one continuation of this threat, boasting far greater complexity than its older cousin. Unlike Mirai, Torri tries to be stealthier. Alongside launching rapid-fire DDoS attacks, it aims to exfiltrate sensitive information from the device, boasting modular architecture capable of fetching and executing other commands; all of which is encrypted via multiple layers of communication.
Protecting Yourself from the IoT Threat
As the botnet threat grows and highly sophisticated threats become inevitable, it is now mandatory for organizations to move beyond legacy security solutions.
Mitigating the symptoms of today’s state of IoT security requires some key cutting-edge solutions. DDoS mitigation software, for example, is one major feature that can protect your company from the million-strong botnet ranks. In the event of a DDoS attack, your provider will first identify the occurrence of an unfolding DDoS attack. This is detected via malicious IP address identification and common attack patterns. Once a traffic spike occurs, your solution provider issues an alert, following which all site traffic is redirected via powerful scrubbing centers. These are high-capacity servers that focus on parsing illegitimate bot traffic from your genuine users. For the duration of the attack, these servers guarantee that your genuine site visitors can still access the site.
Also Read: Enterprise Cloud Security Challenges for the Finance Services Sector
