NOVEMBER - 2019ENTERPRISE SECURITY| | 19Understanding the Risks of IOT By David Barker, Director of Digital Product Security, Stanley Black & DeckerWith the introduction of every technology wave comes a new attack surface that potentially exposes company data and certainly increases risk.Mobile devices were one of those waves and through mobile device management software, some level of control over risks was obtained. Next came the cloud revolution and the industry is just now starting to have reasonably effective tools to help control that risk. Now we find ourselves on a new wave, loosely called the Internet of Things (IoT) that brings a unique set of risks both inside and outside our corporate perimeters.To put this new risk into perspective, consider that with mobile devices, we really only had to figure out how to manage two unique platforms ­ Apple's iOS and Google's Android. That took years to get right and some would say it still needs work. Similarly, with cloud, only a few primary players have remained viable and most of them are now offering their own tools to help secure our environments, in addition to a plethora of options from mainstream security vendors. It will take some time for the efficacy of these solutions to be proven out, but the industry has responded to the risks and help is on the way.In stark contrast to those two examples, IoT has thousands of different things running on dozens of platforms with capabilities that are as unique as snowflakes. These things range from being powered by small Linux-based servers to barely having the processing power to send unencrypted data across a network channel. Well-meaning users are bringing useful things into our corporate perimeter and into their homes to help solve problems. Thethings get connected to the network and thus to the internet and data immediately begins to flow from and to them. While the data stored and processed by these things is usually fairly benign, they become gateways to the networks they are connected to, and a poorly designed, patched, monitored, and managed gateway poses a threat to that network. Our secure networks may now have hundreds of pin pricks in them, allowing an adversary unprecedented access inside our perimeters. But there are some actions you can take to help reduce the risk.1) Discover the Things ­ You may already have tools that will allow you to discover and obtain some level of information about the things connected to your network. Discovery will let you know the extent of the potential risks that exist in your network today. You can't begin to control a thing until you know that it exists.2) Embrace the Things ­ Like shadow IT, things are here to stay and the best way to understand CXO INSIGHTS
< Page 9 | Page 11 >