As wireless devices flourish, network security pros break into cold sweats
As wireless devices flourish, network security pros break
into cold sweats
BY TIM JOHNSON FEBRUARY 13, 2017 12:01 AM
Sure, your office may seem clean. But it’s probably not.
Invisible network pollution contaminates the space, and it may open a door to
evildoers.
The pollution comes from the growing list of
internet-connected devices: cellphones, security cameras, thermostats, door
locks, printers, speakerphones, even coffeemakers. Not all of them have
up-to-date security patches or strong password protection. All of them are
potential foot soldiers for hackers.
In a report titled “Internet of Evil Things” to be
released Monday, a Boston-based company says the connected devices that
surround us at home and work give indigestion to technology security experts,
who see the rise of a menacing new force.
“Our devices live in an open and free world. They connect
to anything. They connect to good things and bad things. They don’t know the
difference,” said Paul Paget, chief executive of Pwnie Express, the Boston
cyber threat detection firm.
The problem, Paget said, is that much of the
internet-connected world is contaminated with malicious code, or malware, “and
your devices swim in that pollution.”
Increasingly, employees carry their own devices to work,
perhaps unwittingly bringing cyber infections and malware into contact with an
office network, or bringing devices with weak defenses that can be forcibly
recruited into in a hostile robotic network, or botnet, for attacks elsewhere.
The first major alarm about these zombie botnets arose on
Oct. 21 when hackers used malware, which security professionals dubbed Mirai,
to harness an army of enslaved connected devices, mainly security cameras, to
overwhelm a New Hampshire firm, Dyn, that is a backbone of the internet. The
massive attack, the largest of its kind ever, took down internet access in some
metropolitan areas of the East Coast.
Rather suddenly, the risk of connected devices became a
hot topic. Even the most mundane home or office device could seem, well,
potentially virulent.
EVEN THE COFFEEMAKERS ARE CONNECTED AND CAN POTENTIALLY
OPEN A BACK DOOR TO A ROGUE ACTOR.
2017 Internet of Evil Things report
“We now work in offices where the conference room
whiteboards are smart, security cameras are wireless and speakerphones are
Bluetooth. Even the coffeemakers are connected and can potentially open a
backdoor to a rogue actor,” the report says.
To gain a sense of shifts in the mood of information
security experts, Pwnie Express surveyed 868 of them in 80 countries during a
three-week period that ended Jan. 5.
Nine out of 10 said they were concerned about
vulnerabilities in the connected world, which some call the Internet of Things,
the survey found, and 44 percent said they now worried more about random
connected devices than traditional network security.
And there’s bad news: Two-thirds of respondents said they
didn’t know how many connected devices employees brought into their workplaces.
The same percentage said they either hadn’t checked or didn’t know how to check
devices for the Mirai malware.
“They are highly concerned about it, and they don’t know
what to do,” Paget said. “If they don’t know what to do, then the fear starts
to creep in.”
Once focused only on the safety of equipment and
computers they directly controlled, 3 out of 5 network security pros now
realize they have to worry about any connected devices brought through the
doors of their workplaces, the survey found.
Yet only 8 percent said they could continuously monitor
and detect such devices.
“That means less than 1 in 10 IT security departments
could detect Mirai on a webcam, a printer or a device brought from home into an
office,” the report says.
Paget said company security professionals would
increasingly have to monitor all connected devices in range of their networks,
including the odd visitor with a Bluetooth-connected phone or even the wireless
drone that flew overhead.
“Privacy laws come into play,” Paget said, adding that
security pros will simply need to monitor the activity of such devices, “not
touch the data, not inspect it, not drop agents onto machines, but understand
what the behavior is.”
Other experts say the use of malicious Mirai botnets will
increase in the foreseeable future.
“If left un-combatted, (Internet of Things) botnets are
expected to evolve in sophistication and impact for at least the next three
years,” said a research report in December from a cybersecurity think tank, the
Institute for Critical Infrastructure Technology. The report carried the ominous
title “Rise of the Machines: The Dyn Attack Was Just a Practice Run.”
Tim Johnson: 202-383-6028, @timjohnson4
Comments
Post a Comment