The Internet of Things (IoT): New Opportunities, New Risks and and Business Innovation
Internet of Things (IoT), Another acronym or concept of substance?
The internet has enabled networked connections among people, processes, data and “things”, hence The Internet of Things. All these are impacting our lives on a daily basis and becoming the expected norm, and this is bring with it enormas change affecting everything from the way we deliver healthcare to heating our homes to running our manufacturing facilities and other critical infrastructure.
The Internet of Things (IoT) is creating unprecedented opportunities for both individuals and organizations to gain greater value from networked connections among people, processes, data and things.
These connected devices are impacting our lives on a daily basis, changing everything from the way we deliver healthcare to heating our homes to running our manufacturing facilities and other critical infrastructure. Today there are 10 billion connected devices but that number is expected to grow exponentially – exceeding 50 billion sensors, objects, and other connected “things” by the year 2020.
The ultimate goal of IoT is to increase operational efficiency, power new business models, and improve quality of life. By connecting every day objects and networking them together, we benefit from their ability to combine simple data to produce usable intelligence.
However, this also means there is greater potential that more personal information and business data will exist in the cloud and be passed back and forth, and with that comes significant implications for applying proper security to protect the data and establishing privacy policies.
While the IoT has created a wealth of new opportunities, with more and new device types connecting to the extended network, it’s also given cyber criminals and nation states new and unforseen ways to potentially gain access to systems and information.
To capitalize on the opportunities that the IoT brings, doesn’t just require networked connections but secure networked connection. Security is not just a top consideration, but one that is foundational to delivering on the promise of the vision.
The New Risks
With the future connection of billions of devices, the number and type of attack vectors will increase, as will the amount of data, creating a daunting challenge for companies and those responsible for defending the infrastructure.
It’s no longer a matter of if attacks will happen, but when. Incentives for attackers are extremely large, and all organizations must understand how attackers pursue valuable.
So what are the real risks? Through its network of security research programs and initiatives, Cisco examines threat intelligence and cybersecurity trends. These are shared semi-annually through Cisco’s Midyear and Annual Security Reports.
The security report underscores just how many different types of weak links exist in the systems we trust, including the Internet itself, and what can be done to reduce their number and impact. In addition to cybersecurity trends for the first half of 2014, the report also discusses how:
IoT devices could be used as infection vectors to spread malware across organizations, or become the source of denial-of-service attacks which could in turn cause damage or in some instances, loss of life.
These concerns were voiced by 26 percent and 13 percent of people surveyed by the SANS Institute.
Privacy
When adversaries reach a point where they can begin correlating information from different sources—a car, a smartphone, a home automation system—they will be able to gain a much bigger picture about a user than if they were looking at information from only one device, system, or application.
These details about users, from their shopping habits to their physical location, will allow actors to launch well-crafted, highly targeted campaigns at a level of sophistication never before seen.
Forgotten assets
There is the pressing concern of the growing population of abandoned and unmanaged Internet-connected devices. In addition, one issue that cybersecurity practitioners foresee is that these forgotten assets won’t get patched via any systematic means leaving them highly vulnerable.
To combat these threats across the entire attack continuum — before, during, and after an attack, organizations need pervasive protection across a broad range of attack vectors.
Strengthening weak links across the security chain rests largely upon the ability of individual organizations and industry to create awareness about cyber risk at the board level and make cybersecurity an imperative for the business.
The New Opportunities
There are not enough resources or expertise to address all the data and events across the exploding number of connected devices. However, organizations that address these emerging challenges with a holistic approach can be better prepared to capture value from new opportunities and insights.
What’s needed is a threat-centric and automated approach to Security that spans both the operational technology (OT) where many of the IoT devices often live and information technology (IT) domains.
Traditionally, organizations control and monitor these environments separately. As the OT layer becomes increasingly IP-enabled and web connected, the OT layer can become a point of vulnerability that security adversaries can attack directly or pivot from to attack the IT layer. Thus the need for a unified approach across both domains that delivers the following capabilities:
Visibility-Driven: The more we can see, the more we can correlate information and apply intelligence to understand context, make better decisions, and take action—either manually or automatically. This capability has broad implications for not only IT security, but also across the entire enterprise.
Threat-Centric: As we focus on detecting, understanding, and stopping security threats through continuous analysis, real-time security intelligence can be delivered from the cloud and shared across all security solutions to detect and remediate against threats.
Platform-Based: Security is no longer solely a network issue. It requires an integrated system of agile and open platforms that cover the network devices, and the cloud.
While there is no silver bullet to addressing every security risk, intelligent cyber security is what will enable a secure IoT and IoE world.