How to Build a Resilient IoT Framework

Internet of Things (IoT) has introduced enormous benefits to society over the years. With great power there must also come great responsibility to protect it. As the number of IoT devices grow and become embedded into the corporate ecosystem and so is the need to provide security for it as a top priority.

The challenge is many IoT devices were not designed with security in mind. Many devices do not have an interface, lack basic security features, and simply cannot be updated or patched in the event of a software vulnerability. The global workforce continues to be digitally dispersed across the home and office devices this provides a unique challenge for security and risk leaders to overcome. This is further complicated as IoT devices move outward to partners and the larger supply chain.

Recent Examples Where IoT Devices Have Been Compromised:

• 100 million more IoT devices are exposed—and they won’t be the last
• Medical device cybersecurity raises its head in CISA warning – Zoll Defibrillator Dashboard would execute contents of random Excel files ordinary users could import
• Honeypot research reveals the connected life might not be so sweet

As 5G speeds things up even further and devices with embedded IoT capabilities start to come to life the opportunity to get a hold of this tsunami will is coming to a rapid end. Implementing best practices now will ensure your organization is able to proactively get ahead of this and mitigate your risk exposure to an attack.

1. Accurately identify your complete attack surface – Accurately and completely identify all connected assets everywhere your corporate ecosystem; inside and outside your physical four walls.
   1.  Ensure that you have granular details on every device such as make, model, operating system, serial number
   2. This allows organizations to gain real-time continuous visibility and insights into all of their assets such as those with weak certificates, poor passwords or vulnerabilities so they can be managed efficiently and effectively
2. Find active threats more quickly and accurately – Continually detect known and unknown threats as they happen with actionable insights.
   1. Consider threat detection solutions that can detect exploits, attacker tools (such as Cobalt Strike or Eternal Blue), and lateral movement
   2. Map and baseline device behavior to identify anomalous behavior such as C2 communications to malicious domains.
   3. Utilize rich device context to discern what is happening to which devices exactly where the moment it occurs. The Mean Time To Detect (MTTD) is critical in mitigating the impact a threat has on your organization.
3. Immediate Response – Take fast, targeted actions to impacted devices to eliminate operational downtime.
   1. By implementing a Zero Trust security posture across network, endpoint, as well as other telemetry in your infrastructure you can reduce the next critical metric is the Mean Time to Respond (MTTR).

Implementing these best practices is not an easy task. Ordr is here to help. Contact us today!

Brad LaPorte

Former Gartner Analyst and partner High-Tide Advisor.