Intelligent CISO Issue 54 | Page 38

One of the main issues with IoT devices is the lack of awareness that IT organisations have over their estate .
Data breaches , cyberattacks and privacy issues are often the result of IoT devices being compromised .
FEATURE
business ; such as the CNC machine tools used by an industrial manufacturer . IoT devices on the other hand suffer from ‘ device sprawl ’, whereby it ’ s easy for relatively cheap devices to be deployed to office buildings , the majority of which just use Wi-Fi for connections .
This lack of awareness means that these devices are not part of the corporate patching and firmware updating processes . In particular , this failure to routinely update firmware has thus far been quite an issue .
Data breaches , cyberattacks and privacy issues are often the result of IoT devices being compromised . Once a vulnerable IoT device has been breached , bad actors can often move laterally within a company ’ s network , depending on the network ’ s architecture and the device ’ s type of connection .
More worryingly , we ’ re now seeing IoT devices falling victim to command-andcontrol ( C2 ) attacks . It was recently determined that Trickbot , a malware that previously targeted computers and IT systems , is now affecting IoT devices . Trickbot has compromised IoT devices and then used those devices to attempt lateral movement and gaining access to the target network with more critical data .

One of the main issues with IoT devices is the lack of awareness that IT organisations have over their estate .

As if this wasn ’ t enough , the growing adoption of OT in many industries – and manufacturing in particular – presents bad actors with a potential opportunity to conduct cyber-kinetic attacks in which their attack in cyberspace impacts the physical word . For instance , by preventing a centrifuge from automatically slowing down at a set point , an attacker could cause the centrifuge to continue spinning until it breaks down which could injure nearby workers .
The potential for such attacks to disrupt or even shut down business operations is real . To ensure adequate protections against these attacks , it is important to first understand the most significant issues that put IoT and OT systems at risk :
• Lack of visibility : The old saying ; ‘ you can ’ t protect what you can ’ t see ’ is just as applicable to IoT and OT as it is to other IT environments . Unfortunately , many companies lack the necessary instrumentation to discover all of their IoT assets and gain visibility into their entire IoT estates .
• Poor patch management : Most of the standard device management toolsets like Microsoft ’ s Configuration Manager are not capable of patching IoT devices . Even when organisations account for the IoT devices in their environment , they don ’ t always manage them appropriately .
• Insecure software and firmware : It is an unfortunate truth that IoT and OT devices often have inherent software and firmware vulnerabilities ,

Data breaches , cyberattacks and privacy issues are often the result of IoT devices being compromised .

38 www . intelligentciso . com