Threats to the IoT won’t change without privacy by design

Threats to the IoT won’t change without privacy by design

Steve Mulhearn, Director of Enhanced Technologies, Fortinet

As security professionals, we are always trying to anticipate the way that the threat landscape could evolve. An important new frontier is the opening up of the mobile network to 5G.

Unlike previous generations, 5G technology takes advantage of virtualisation and cloud systems, leaving it more vulnerable to breaches if not properly secured. It also promises higher speeds, lower latency and increased power. What is interesting is that threats can evolve and become more of an issue because of technological advancements designed to make our lives easier. Think common colds becoming resistant to antibiotics. One undoubtedly good advancement causes the mutation and increase in threat of something else. This is very much the situation we find ourselves with 5G and botnets.

Botnets are something which we sometimes don’t think about because they are ‘dumb’ attacks in nature. No network can stand up to millions of bots all spamming it at the same time, and there is usually no sophisticated network breach involved. Botnets are still a popular and active threat. In fact, we are still uncovering new variations of the 2016 Mirai botnet attack on Dyn, which took down most of the US east coast.

The concerning aspect is how these may transform. Looking at the Dyn attack and adding in the greater speed and power of a 5G network could give hackers even more powerful tools to exploit. Distributed denial of service attacks could increase in scale and frequency, causing untold disruption to business or critical infrastructure.

Unsecured IoT devices form the foundation of such Botnet attacks. Devices without proper security certifications, or those which use default password settings can easily be hijacked for other purposes. We all have heard about the growing proliferation of internet-enabled devices into nearly every industry and individuals’ lives, and the consequent increase in the potential attack surface. What is striking about this trend is the continued lack of an overarching strategy. Some manufacturers, vendors or network providers speak of their plans to combat cyberthreats, but others are silent. This leaves weak links in the chain when it comes to defending against botnet threats.

Prevention and structural change are the only antidotes. Behaviour change is an important and effective remedy which the security industry must strive to accelerate. However, 5G is coming in the next few years – a schedule which does not allow enough time for the scale of behavioural change necessary. That is why we need to see a greater focus on security by design from manufacturers. It is only when stricter security protocols, randomised default passwords and more are introduced that we will see a reduction in the number of IoT devices being hijacked for botnet purposes.

Steve Mulhearn will be at Infosecurity Europe 2018 on 5th June. Fortinet will be at stand E110.

Leave a Comment

Your email address will not be published. Required fields are marked *