Are you one of those businesses who does not know what devicesare attached to your network? If so, you are not alone, but you should understandthat this can lead to a significant increase in risk and unknown gaps in your organisation’ssecurity.
Based on research conducted by Security firm Forescout, 49% of the 500 UK companies that were polled, said that they did not fully understand their IT assets and believed they had unknown devices connected to the network.
Although this is a small sample, this could mean that up to 2.8million businesses in the UK are exposed to unknown cyber threats, related tounmanaged or even malicious devices.
The Internet of Things (IoT) has caused a huge explosion inthe amount of internet connected devices, across both business and home networks,and this shows no sign of slowing down.
With more and more IoT devices connecting to corporate networks, Gartner predicts that as many as 20 billion devices will be internet connected worldwide by 2020. The biggest risk in this area comes from a lack of visibility and control over network assets.
Ironshare have witnessed this position many times whenquestioning our existing and prospective clients about their security. Having anunderstood and documented network always seems like a very low priority formost organisations.
During our assessments we have identified numerous instancesof IoT and network devices present on customers networks that they were unawareof. These have ranged from rogue wireless network devices, to IoT security camerasdirectly accessible from the internet with no authentication, which could notonly compromise the internal network but also the sites physical security.
With ‘Inventory and Control of Hardware Assets’, sittingright at the top of the CIS list of 20 Critical Security Controls, at minimum amanual inventory should be a key item created and maintained under anyorganisations security strategy.
“After all, if you don’t know about it, you can’t manage and control it.”
The lack of visibility can lead to devices that arevulnerable to unpatched flaws, leaving them open to malicious exploitation. Whiletypical IT focus will monitor critical assets such as servers, security andnetwork devices, and possibly desktops and laptops, IoT devices are oftenforgot, ignored, or unknown, making them prime targets for bad actors.
With a single unknown device compromised it is possible for theseactors to use the device to laterally move around the network, infecting orhijacking further machines, often without the company knowing about it.
Organisations should apply a level of focus to understanding their technology estate and defend against common cyber threats. Below are a few guidelines you can follow to improve this area:
Stuart Hare is a Technologist with a passion for helping people in all aspects of IT & Cyber Security. Stuart is the Founder of Ironshare, an Information and Cyber Security company providing consultancy and managed services.
Samuel is a Security Analyst with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
Joshua is working as a Managed Service Lead with Ironshare, an Information and Cyber Security company providing Security consultancy and managed services.
