The Internet of Things (IoT): Is it a Security Threat? | #CyberSentinel EP 007

In this episode of Cyber Sentinel. we're discussing today's trendy buzzword in tech: IOT. What is it? and is it a potential threat to us?-

So what is the Internet of things, and why is that important for corporate networks? Find out today on Cyber Sentinel. So welcome to Cyber Sentinel, this is Alan Adcock. I'm CEO of ASC Group. And we appreciate you sending questions in over social media to #cybersentinel. We're gonna get to a couple of those questions here today.

What is the fundamental data that I need to have prepared before I talk to an IT consultant?

So we continue to go out and meet with small to mid-size businesses on a regular basis, and one of the fundamental pieces of information that they don't normally have at their disposal is just a true inventory of what's plugged into their networks. Anytime that we've got devices plugged into a network, we need to have a full inventory of those, so we know who owns them and make sure that they're getting updated and maintained on a regular basis. Oftentimes, we can solve a company's problems using tools that they've already got. They just don't know that they have them, or they don't know fully how to implement those features. An inventory really helps us to figure that out on the front end of those engagements. Recently, we talked to a company that was having issues with restricting some access to data on their network and were looking to us for a solution to that. We were able to actually restrict that data and solve that business problem without having to purchase any additional tools, just by using information and tools that we found were already deployed.

I see IOT in the news a lot. What does it stand for and what is it?

So, IOT stands for Internet of things. It's a buzzword, marketing buzzword, in the information technology industry these days. Really what Internet of things refers to is all the connected devices that have been coming out on the market recently. And we're talking about that on Cyber Sentinel because there are security implications to all these little devices. A good example of IOT devices are all your video cameras for security applications. Even refrigerators and coffeemakers and doorbells and thermostats, all those things in your house. Your house is probably full of this stuff. All these devices connect to the network and, because the development timelines for these are really short, everybody's trying to get into that market very quickly, a lot of these don't have good security protocols in place on these devices. And we're finding that these devices can be leveraged by hackers to form a foothold into a network. In the home, this is pretty prevalent. It's not as big an impact maybe 'cause of the type of data that you have at your house, but in a corporate network we really want to get controls around these kinds of devices. So, when we look for these on a network, we want to see how can we segment these devices off of the corporate data and make sure that, if they are compromised, the impact of that compromise is lowered. In the home there's not a lot you can do to defend yourself. Most people do not know how to upgrade the firmware and the software in their smart television or their refrigerator. But these are the kind of things we have to worry about on a corporate network, and making sure that those IOT devices are segmented in a way and protected in a way that they're not gonna impact the data that's on the network. We had a company recently that contacted us. They were having major performance issues. They thought their ISP was not delivering the bandwidth that they were paying for. It turned out that, when we went in and looked at them, their bandwidth was completely being used because one of their IOT devices had been compromised, and unknown actors were using that device to share out files across the Internet. Once we put some controls around that device and got it cleaned up, their bandwidth was restored to normal, and they were able to continue with the business operations. So, we needed to pay attention to those IOT devices on the corporate network.

What trends are you seeing in the technology landscape?

So some of the ASC staff members recently went down to Florida for the Fortinet Accelerate 2019 conference. This is a conference on cybersecurity put on by one of our vendors, Fortinet, that has a lot of products in that security space. There's several major themes that came out of that conference. IOT came out of that conference, and the impact of IOT devices that are showing up on corporate networks. Most of these devices in a corporate setting are an issue because nobody really owns those. Once they're on the network, if it's a workstation or a server or an application, there are departments that own them. These are sitting in between departments, and so we're trying to get our hands around, corporate security-wise, how to handle those IOT devices. Another major theme coming out of that conference was, in the security space we used to focus on finding the best of breed product for whatever security item that you're looking for. Like we're gonna try to find the best of breed antivirus. We're gonna put that in. Best of breed firewall, et cetera. And, nowadays, we're looking more and more at solutions that all integrate together, trying to fill the gaps between those solutions. So, rather than focusing just purely on a best of breed solution, we want stuff that's gonna talk to each other and coordinate effort in order to help us to address a lot of these security threats that are emerging on the networks today. And the third trend that we saw at the conference was a lot of discussion on how do we deal with the massive amounts of data that are now being collected off of corporate networks by security tools. So, we're adding what's called telemetry to corporate networks, which means we're collecting data about how that network performs and using that data to identify threats that are on that network. So, as we're queuing all this data through the various sensors that we're able to deploy now, just sifting through that massive data is becoming a big data problem. So, a lot of trends in the industry are around how do we use AI and other advanced tools to sort through that data, and really bring people's attention to the pieces of data that are really important that they need to look at, so that those things don't get lost in the noise of that network. So, from a trend standpoint, those are three of the things that we took out of that conference. And there's all tools that are being developed to help us to address those trends.

So this is Alan Adcock. I'm with Cyber Sentinel, and we appreciate your questions. If you have any questions that you'd like to have us address in a future episode, please find us on social media at #cybersentinel.