Today in the Evolve IT Lab, Ben and Lachie discuss the security risks of the Internet of Things. Each organisation will find that they have 100's of IoT devices connected to their network. Although these devices help both company and user be more efficient, they can pose a significant security risk to an organisation.
Each time you buy an IoT device be sure to check and change a few things like:
- The default username
- The default password
- The network address
- Limit it's access to your network
- segregate it form your business network
- Keep and asset management of all your devices
Lachie: Good day guys, and welcome back to the Evolve IT Lab. My name is Lachie, and we've got Ben from Sophos. Welcome back, Ben.
Ben: Thanks for having me again.
Lachie: Guys, today we're gonna be discussing a broad term called IOT, and its security risk on your organization. First of all Ben, what is IOT?
Ben: Absolutely, so IOT stands for Internet of Things, and it's really a collection of devices that aren't managed by an organization. It's you know your smart lights, your smart fridges, that kind of thing.
Lachie: Yeah, right. So what are some of the risks with IOT?
Ben: Absolutely, well they're hard to manage and they're hard to control. Generally, they're managed by another vendor, so you can't do a lot. And even things like say an IP phone system or a VOIP system, those handsets can be considered say an IOT device, so do you have any control over that? Can you change the default password? At the end of the day, it is a small computer, it's say running embedded Linux or embedded Windows, so an attacker could get access to that and leverage that to further attack a system.
Lachie: Yeah, right. So it can, IOT there's so many things within the organization that could term. Yeah, right. So how can you go ahead and protect things like the internet like IOT hacking and protected?
Ben: Absolutely, so the biggest thing is segmentation. Say if you use a shop for example and they have their pulse systems and they had some public access to Spy systems that a site a display in advertising. They should be a 100% segmented from one another, you should not have them on the side of network because those pulse systems may be protected by clover policies, and antivirus and firewalls, but if someone can walk up to a TV and say plug a USB stick in there that then it gives them remote access to it, well then they've compromised your whole network. So looking at segmentation is the best way to deal with IOT.
Lachie: Yeah, cool. So I know a lot of IT guys out there and whenever they're installing things like backups even, they put those on a separate network just to protect the segmentation as well. So you're saying put security cameras in everything on a separate network, and keep it separate from your corporate stuff.
Lachie: That's a great tip. All right guys, well thank you, Ben.
Ben: Thank you.
Lachie: And thank you everyone. We'll see you next time.