Connecting “things” to the internet can date back to the birth of the internet in 1989, with the first internet connected device being a toaster. The term Internet of things (IoT) was brought about by in 2000 from the first “smart” refrigerator, writes Daniel Pike, MSc, MSyl.
Moving on from smart toasters and fridges Apple’s iPhone in 2007 was a critical event that sparked the IoT to which it had brought communication and recordings of voice, video, and photography on one device to many people. The IoT is also used by government and education sectors and affects the way people order food, book holidays and even vote.
With smart devices automatically connecting to the internet and sending and receiving data this can create serious security vulnerabilities. These vulnerabilities affect organizations due to a universal plug and play protocol (UPnP) which gives access via a default password. In turn this gives room for malicious emails, personal data theft or physical harm to devices such as making them inoperable.
Ways to mitigate these problems would be to disable UPnp routers or isolating IOT devices to their own networks. With the increase of mobile devices and the use of personal mobiles in the workplace this has created major cybercrime risks. This can be due to the employer using their mobile for work but using the incorrect security settings, thus ensuring the correct security settings could reduce chances of attack. Hackers can get into hospital networks through insecure devices connected to hospital networks, this access could even be through an MRI machine. More ways to combat cyber related crimes associated with IOT could be the use of software updates and the implementation of firewalls.
Social exchange theory suggests that people evaluate good and bad consequences of social environments. This could be applied to the social cyber world through the use of social media sites. Social media sites enable people to create an online profile of themselves and communicate with others online and share information.
Social media can be vulnerable to social engineering, which is a term used when a criminal uses someone else’s private information for their own gain, such as fraud or identity theft. This is due to the person posting personal information such as their name, address, date of birth, family connections and other information such as photographs.
The IoT has had a positive impact in the workplace, allowing businesses to operate better and develop new technologies. The healthcare sector is an example of this where applications used on smart devices work with tags which can be placed inside cancer patients to monitor them and send data. Diabetes patients also use this type of technology which links to their phones to remind them when to take medication. Additionally technology using the IOT has created smart insulin pens which record the patient’s usage.
Bring your own device (BYOD) is when employees bring their own devices such as smart phones, tablets and laptops that are connected to a company’s servers and database with access to emails and files. This in turn can cause security and privacy threats. These threats could be a malware attack through an app which can also lead to loss of security controls. The use of other non-business related activities on these devices can also lead to data breaches and legal liabilities. IPods have been used by employees to steal information from business premises due to their capability of holding large amounts of data and being inconspicuous. Criminals have also been known to previously drop memory sticks in company parking areas which have malware on. This could be transferred onto a company computer by an employee accidentally. IPads can also contain a lot of company information, if stolen or lost this can be used for cybercrime.
Malware is an example of a threat to an IOT device. It is a short term for malicious programmes and allows an attacker to attack multiple devices quickly due to its ability to mix programmes such as a viruses, Trojans and worms. A malware attack can affect millions of devices within minutes. The NHS WannaCry ransomware attack is an example of this, which was spread through email, by tricking the victim into opening a malicious file or link known as phishing. When Ransomware attacks a computer it locks the user out until a payment is made.
Installing antivirus software can help mitigate against malware threats, however this doesn’t guarantee complete protection due to the vast amount of different types of virus out there including new ones being made. keeping all systems and software up to date also helps prevent malware attacks, this is due to when a security flaw is recognised in a previous update an attacker will exploit this thus updating to a new patch protects against that flaw.
The use of a cyber response plan can help companies decide how they respond to an attack at different levels, this in turn can help contain and defend against an attack and see were to improve in the future. The cycle of a response plan is planning, detection, analysis and response formulation, containment, eradication, recovery and post incident recovery. The planning part is to have a skilled incident response team with prior knowledge of cyber threats who can carry out a security response plan. The detection part of the plan recognises the incoming threat. The analysis and response part of the plan is to gain as much information as possible on the threat and consider how to defend against the threat and how to improve defence it in the future. The containment part is to limit and prevent damage to systems as soon as possible, this could by swapping infected devices or stopping affected services. The eradication part of the plan is to remove the threat and prevent the threat from returning in the future. The recovery part is restoring the system back to normal so it can carry out its normal service as soon as possible. The last part of the response plan is the post incident activity were the incident is analysed and reviewed to prevent it happening again.
Despite the threats that security in the workplace face from the IoT there are responses that can be taken to mitigate threats, such as keeping systems up to date or using firewalls to detect and prevent threats. There are also practices that businesses can introduce such as audits to help deter internal attacks and test current systems effectiveness For those bringing their own devices into work companies can also implement procedures such as a BYOD procedure to create strict controls of the use of IOT devices.
About the author
With a policing background Daniel has focused on a career in security where he has gained knowledge and experience in manned guarding, close protection, risk and commercial security. He has ambitions to gain a doctorate in security and risk management and become a Chartered Security Professional.
