6 steps to IoT security

In June, Sen. Maggie Hassan (D-N.H.), the ranking member of the Federal Spending Oversight and Emergency Management Subcommittee, sent out a detailed memo asking agencies to answer questions in six key categories about their legacy IT spending and modernization efforts. The timing of this call to action was incredibly important given the pandemic and the strain it has put on legacy IT systems, which is not a new problem, but one that was thrust back into the spotlight.

“The public health emergency caused by COVID-19 underscores the need for federal agencies to invest in modernizing current IT systems that cannot meet mission critical expectations in a crisis,” she wrote. “Failing to do so could result in costly errors, security vulnerabilities, and inability to serve the American people.” 

In July, the National Security Agency and the Cybersecurity and infrastructure Security Agency urged the Defense Department, essential national security systems, the defense industrial base and U.S. critical infrastructure facilities to take immediate actions to secure their operational technologies assets -- i.e., the hardware and software that monitors and controls industrial operations. The alert was timely, as threat actors have leveraged internet-connected devices to exploit critical infrastructure during the pandemic.

Most recently, the IoT Cybersecurity Improvement Act, which was signed into law by the president on Dec. 4, requires internet-of-things devices purchases and used by federal agencies to conform to basic security requirements.

What these calls to action have in common is the very real and pressing need for the federal government to address its IT modernization needs while ensuring cybersecurity is a critical part of the equation. Specifically, government must focus on securing IoT devices, which have become an effective threat vector for exploiting critical infrastructure in all industries – from health care and defense, to manufacturing and logistics.

Shifting from reactive to proactive security

IoT devices and systems are designed for ease-of-use rather than for security, and thus they often lack the ability to detect or mitigate malicious activity. The design of these devices and systems, combined with the data that they transmit and share via the internet, make them an easy target.

Not only have these devices been created without security in mind, but they often run obsolete or legacy operating systems that cannot be patched. Because there can be hundreds of thousands of these devices in a network, the process of securing them must be automated. IT and security teams already face foundational and complex issues every day, and without alleviating some of the manual work, there are far too many tickets and incidents for even the largest most robust teams to handle.

So, where should a federal agencies start when it comes to understanding, tracking and protecting their networks from vulnerabilities associated with IoT devices? Here are six key steps agencies can take when shoring up their IoT security strategy:

1. Gain visibility: Have an accurate and current inventory of all managed and unmanaged devices. The most efficient way to have clear visibility is via deep packet inspection on a network tap or SPAN, which will deliver high-fidelity information about every connected device including make, classification, location, operating system, serial number and application/port usage. This visibility must be provided in real time without impacting devices or the environment.
2. Understand behaviors: Know how all devices are behaving and what other parts of the network they are – or can – communicate with. Machine learning and understanding device behavior are a perfect match. The ability to baseline device communications is critical for organizations as devices are being added on the network constantly often without the IT and security team's knowledge.
3. Centralize management: Identify and leverage a single dashboard that allows tracking and investigating at-risk devices. Whether this is consolidated into the chosen IoT device security vendor or it is seamlessly is integrated into existing maintenance and configuration management systems, extended to security information and event management tools or used to supplement network access control.
4. Implement segmentation: Control -- and limit -- at-risk device connections through segmentation. The ability to automate segmentation and micro-segmentation policies with high-fidelity device information can be crucial. From understanding which VLANs/subnets devices are on, to establishing proper segmentation and then automating the process for new devices, organizations are leveraging vendors with these capabilities to ease the implementation and deployment process.
5. Establish continuous monitoring: Get timely notifications of new devices, offline devices, potential risks and threats. Ransomware, such as Ripple20 and Ryuk, has proliferated through organizations, making continuous monitoring of network connected devices, along with proper baselining and segmentation, critical when ransomware hits.
6. Automate incident response plans: Automate the device-impacted workflows for the IR process by creating and enforcing segmentation policies or alert- and trigger-specific security or operational workflow actions. Often, organizations will leverage the rich device context supplied by specialized device security vendors to influence their IR workflows and make note of any proactive pieces they must carry out.

These six steps can provide a path and a framework for federal agencies to address potential threats from managed and unmanaged IoT devices -- wherever they might be.

Cybersecurity will continue to be an ongoing and evolving challenge, but having visibility and insight into what devices touch agency networks and how they behave will give government agencies and the contracting community a clear understanding of whether IoT will be a best friend or a worst enemy.