Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Trustwave SpiderLabs Uncovers Ov3r_Stealer Malware Spread via Phishing and Facebook Advertising. Learn More

Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

How to Secure Your Internet of Things

You didn't have to attend this month's Black Hat and DefCon shows in Las Vegas to draw one big conclusion: Researchers are having a field day with hacking internet-connected devices. Conference-goers were treated to presentations detailing how to compromise cars, rifles, skateboards and safes, just to name a few.

Now the big question is: Have we reached a tipping point that will awaken both developers and adopters to the security risks posed by these products?

Of course, the concept of taking advantage of vulnerabilities in the Internet of Things (IoT) - the network of physical objects that are embedded with technology enabling data exchange via the internet - is nothing new.

But many people still view IoT as novelty, even though it is morphing into normality. If you can look past the so-called smart home of IP-enabled toasters and sprinklers, the Internet of Things is rapidly expanding into the business world, where use cases for IoT abound - from traffic monitoring systems in cities to sensors that target shoppers with special offers in stores to implantable medical devices for patients in hospitals to industrial automation systems in power plants.

Studies are shedding light on the astonishing rate at which IoT is growing: Surveys estimate that by the end of this decade, some 25 billion connected objects will be in use. These devices will generate a projected 44 trillion gigabytes of data by that same year.

Those types of numbers will incite adversaries. And based on the success that researchers already have demonstrated, it appears history is repeating itself in terms of the security and vulnerability of these technologies. As we learned with the rise of the internet and the ensuing mobile age, security often gets overlooked in the development, implementation and maintenance stages - and here's yet another trend that will further widen the risk profile for a company.

That simply can't happen considering there are soon to be tens of billions of IoT products, which may be enticing in their own right but also provide plush entryways to the larger corporate network where a host of problems can occur, including denial-of-service attacks, privacy violations, malware infections, system hijackings, sensitive data theft and even bodily harm.

By no means an exhaustive list, here are five things you should be doing to secure your Internet of Things and reduce your risk, either as a developer or an implementer:

Know what you've signed up for

If you're creating or deploying an IoT technology, understand how it operates. What data is it collecting? Why is it being collected? Where is it stored?

Avoid the market rush

Security should never be an afterthought. A breach will undoubtedly prove more costly in terms of notification, recalls, lawsuits and remediation than you would have spent if security was built in and maintained from the start.

Test, don't guess

Security testing helps you understand what assets reside on your network and discover weaknesses across your IoT environment - in embedded devices, interface applications, back-end services, APIs, cloud clusters and the connections in between.

Hold vendors accountable

If you're purchasing IoT from a third-party, vet their security in much the same way you would your own. Aside from obtaining a service-level agreement that addresses end-to-end requirements, ask them directly: "What do you do to ensure the security of your IoT product/service and are you able to demonstrate that?

Practice defense in-depth

IoT is not just the endpoint, but an entire ecosystem that requires a thorough set of security measures, including authentication controls, DDoS protection, intrusion prevention, web application firewalls, incident monitoring, patching and incident response.

A recent Trustwave webinar comprehensively covered the IoT revolution and what it means for the security of businesses. You can watch it here on demand.


Latest Trustwave Blogs

Defending Healthcare Databases: Strategies to Safeguard Critical Information

The healthcare sector continues to be a primary target for threat actors, with 2023 seeing a record number of data breaches and compromised records. While successful attacks are inevitable, it’s...

Read More

Trustwave SpiderLabs: Ransomware Gangs Dominate 2024 Education Threat Landscape

The security teams manning the defenses at the higher education and primary school system levels often find themselves being tested by threat actors taking advantage of the sector's inherent cyber...

Read More

LockBit Takedown: Law Enforcement Disrupts Operations, but Ransomware Threats Likely to Persist

The news that US, UK, and other international law enforcement agencies disrupted LockBit is welcome, as stopping any threat group activity is always a positive. The unfortunate aspect is this blow...

Read More