Weak passwords can hurt any organizations security efforts and make any device easily hackable, but could they also be the greatest point of failure for internet of things (IoT) security? Weak passwords certainly put companies deploying IoT devices at greater risk of falling victim to a cyberattack.
We have already begun to see attacks targeting IoT devices, and they are using weak passwords as their way in. In 2019, threat actors took advantage of poor password management to go after popular office IoT devices like printers and phones. Already in 2020, weve seen an IoT attack target routers and result in a password data dump on a hacker forum.
Included among the vulnerable (and hacked) passwords are default passwords used by manufacturers that give the appearance of IoT security layers. In reality, all these passwords do is create an illusion of safety for users who assume that because there is a password attached to the device when it comes out of the box, that is all that is needed. The actual outcome in these situations is a larger attack surface of poorly defended endpoints for malicious actors to penetrate with ease.
Without better password management, IoT security could quickly become unsustainable.
The IoT is a hot commodity. At the Consumer Electronics Show (CES) in January, IoT devices were everywhere, in every conceivable form. We are close to reaching a point where every item we can imagine has smart technology built in, which means there is a rush to get those devices to consumers before someone else does.
Manufacturers are focused on getting smart devices into the market as quickly as possible, but in this race to capitalize on the IoTs potential, security is often woefully neglected, explained Michael Greene, CEO of Enzoic, in an email conversation.
How far down the priority list is password security or any kind of security for these manufacturers?
Numerous connected devices ship with default passwords as standard, as was the case with 600,000 GPS trackers manufactured in China that had a default password of 123456, said Greene. Government doesnt see IoT security as a high-priority issue either, so regulations around default passwords and the need to build security into IoT devices at all are currently minimal. This means the responsibility of securing these devices lands on the shoulders of users and IT departments.
But users and IT departments arent keeping up. The work here isnt limited to simply replacing default passwords, according to Greene. Rather, it must include growing smarter about overall password management. To illustrate why this is necessary, consider the fact that nearly 60 percent of users employ the same password across multiple devices, websites and other access points, according to a survey from LogMeIn.
In this environment, a hacker can easily obtain a password that was previously exposed in a breach and use it to gain access to other systems and devices, Greene added. Because of poor password management and weak passwords overall, he believes well see more attacks directed at smart devices, especially if matters of IoT security arent viewed as pressing concerns from the start and addressed across the entire development and sales ecosystem.
Change wont come easily. Users are set in their ways regarding passwords, and IT departments often have more immediate issues than the need to monitor IoT passwords, especially if they are responsible for dozens or hundreds of devices across their organizations.
Yet the IoT is becoming a major player in the overall threat landscape, said Yaniv Balmas, head of cyber research at Check Point Software Technologies, during a conversation at CPX360 in New Orleans. The security level of these devices is already relatively low, but any change that improves device security costs money, either on the development side in which case the cost is typically passed on to the consumer or on the user side.
Cost tends to win, said Balmas, and we want cheaper products.
But all is not lost when it comes to securing IoT devices. Companies are turning to solutions beyond passwords for authentication. For example, Amazon is looking at connecting its payment kiosks in brick-and-mortar stores to biometric identification methods that would prompt the customer to use the palm of their hand to verify their identity, which would be linked to a credit or debit card. Another positive step is the IoT Security Rating Program instituted by UL, formerly Underwriters Laboratories. The UL Verified Mark will alert consumers to the security risks and standards associated with a wide array of IoT devices.
Manufacturers must take security more seriously in the development stage, and companies must leverage advanced authentication options as they become available. Until then, it will be up to users and company security policies to ensure IoT devices are secure. This will require a simple first step: immediately changing default passwords to something strong and unique. As long as we continue to use weak passwords on IoT devices, we will be putting our organizations networks and data at risk unnecessarily.
- Cyber Security & Network Security Services - Internet ... - February 18th, 2020
- Google Announced US$1 Million for its Be Internet Awesome Initiative - CISO MAG - February 18th, 2020
- Internet security Market Analysis With Key Players, Applications, Trends and Forecast To 2026 - Instant Tech News - February 18th, 2020
- Cybersecurity Level in the Middle East: An Overview of the Cybersecurity Market State - SCOOP EMPIRE - February 18th, 2020
- Quantum internet: the next global network is already being laid - The Conversation UK - February 18th, 2020
- IC3.gov 2019 Internet Crime Report: Its All About that BEC - Security Boulevard - February 18th, 2020
- Sophos Cloud Optix breakthrough IAM visualization is here - Naked Security - February 18th, 2020
- Stay Safe, Secure And Anonymous Online with The Doe - London Post - February 18th, 2020
- Industry Insight: The CCPAs Elusive Reasonable Security Safe Harbor - JD Supra - February 18th, 2020
- WISeKey Drives Innovations in IoT Security with 23 Strategic Patents in the U.S. - GlobeNewswire - February 18th, 2020
- IT Security Consulting Services Market Size, Share, Types, Growth Strategies, Interactive Components, Key Companies Overview and Forecast Outlook by... - February 18th, 2020
- Market Size of Internet of Things (IoT) Security Product , Forecast Report 2019-2026 - Redhill Local Councillors - February 18th, 2020
- Internet of Things (IoT) Security Market Projected To Witness Vigorous Expansion By 2026 - Instant Tech News - February 18th, 2020
- 40% respondents ready to share personal details on dating apps without meeting person - The News Minute - February 18th, 2020
- How to protect your personal information online during tax season - CTV News - February 18th, 2020
- It is with a heavy heart we must inform you, once again, folks are accidentally spilling thousands of sensitive pics, records onto the internet - The... - February 18th, 2020
- Security of online voting questioned | News, Sports, Jobs - The Daily Times - February 16th, 2020
- This may be the last piece I write: prominent Xi critic has internet cut after house arrest - The Guardian - February 16th, 2020
- An Alternative to Windows 7 - Budapest Business Journal - February 16th, 2020
- North Koreas Internet Use Surges, Thwarting Sanctions and Fueling Theft - The Indian Express - February 16th, 2020
- Microsoft Patch Tuesday fixes IE zeroday and 98 other flaws - We Live Security - February 16th, 2020
- 'More guidance and regulation': Zuckerberg requests government rules on 'what discourse should be allowed' - Washington Examiner - February 16th, 2020
- Internet of Things (IoT) Security Product Market: Development Factors and Investment Analysis by Leading Manufacturers 2018 2026 - TechNews.mobi - February 16th, 2020
- Our personal health history is too valuable to be harvested by the tech giants - The Guardian - February 16th, 2020
- Cyber Security Today The latest FBI Internet crime report, adware on the rise, attacks on Wi-Fi and more - IT World Canada - February 15th, 2020
- Indias proposed internet regulations can threaten privacy everywhere - The News International - February 15th, 2020
- Antivirus Is Not Enough in 2020: Here is Why - laprogressive.com - February 15th, 2020
- FBI: Cybercrime losses tripled over the last 5 years - We Live Security - February 15th, 2020
- AIoT Convergence of Artificial Intelligence with the Internet of Things - EnterpriseTalk - February 15th, 2020
- Indias proposed internet regulations could threaten privacy everywhere - The Verge - February 15th, 2020
- Global Internet of Things (IoT) Security Market Key Players, Share, Trend, Segmentation and Forecast to 2026: Cisco Systems, Intel Corporation, IBM... - February 15th, 2020
- Romance scammers stole $475m last year. Here's how to spot them - Verdict - February 15th, 2020
- Safer Internet Day 2020 Together for a better internet - Security Boulevard - February 14th, 2020
- Internet's safe-keepers forced to postpone crucial DNSSEC root key signing ceremony no, not a hacker attack, but because they can't open a safe - The... - February 14th, 2020
- Here's how to avoid becoming a victim of a tax scam - AZ Big Media - February 14th, 2020
- Bithumb Employee Found Guilty of Security Failings that Led to Hack - Cryptonews - February 14th, 2020
- Will your vote count? Ohio working to increase election security - WHIO - February 14th, 2020
- Perimeter 81 Introduces SASE Platform This latest offer is based on a partnership with investor and - Channel Futures - February 14th, 2020
- NHS Secure Boundary the next layer of cyber protection for the NHS - Digital Health - February 14th, 2020
- Global Internet of Things (IoT) Security Market Segmentation along with Regional Outlook, Competitive Strategies, Factors Contributing to Growth and... - February 14th, 2020
- North Koreas Internet Use Surges, Thwarting Sanctions and Fueling Theft - The New York Times - February 14th, 2020
- TechForce Aberdeen event to kick off Cyber Scotland Week - The Scotsman - February 14th, 2020
- Security Strategy: Moving Away From Tried and True - Security Boulevard - February 5th, 2020
- Internet Security Software Market investigated in the latest research - WhaTech Technology and Markets News - February 5th, 2020
- What Is Log Management, and Why Is It Important? - Security Boulevard - February 5th, 2020
- Latest Released 2020 Version Of Internet Security Market With Market Data Tables, Graphs, Figures and Pie Chat - TheLoop21 - February 5th, 2020
- Booter Boss Busted By Bacon Pizza Buy - Krebs on Security - February 5th, 2020
- Yet another Windows 10 fail as new update breaks the internet - heres how to fix it - TechRadar India - February 5th, 2020
- 'Formjacking' Is the New Internet Scam We Need to Watch Out For - q985online.com - February 5th, 2020
- Kiwis think benefits of the internet outweigh the negatives - SecurityBrief New Zealand - February 5th, 2020
- GAO: DHS and Agencies Must Work to Improve Cybersecurity - HSToday - February 5th, 2020
- Government to strengthen security of internet-connected products - GOV.UK - January 31st, 2020
- DigiCert Leads Initiative to Enhance EV SSL Certificates - Security Boulevard - January 31st, 2020
- eScan Internet Security Suite - Download - January 30th, 2020
- Internet Security - January 30th, 2020
- Best malware removal software of 2020: free and paid anti-malware tools and services - TechRadar - January 30th, 2020
- Government to strengthen security of internet-connected products - SecurityNewsDesk - January 30th, 2020
- IoT security: Your smart devices must have these three features to be secure - ZDNet - January 30th, 2020
- Millions of Wawa customers data breached selling on dark web - wobm.com - January 30th, 2020
- DigiCert CEO: Focus Security and Privacy on the Person - Infosecurity Magazine - January 30th, 2020
- CounterAct Cybersecurity Group Launches End-to-End Approach to Help MSPs Protect Their Businesses and Customers from Information Security Threats -... - January 30th, 2020
- The US Space Force Has a Rough Launch on the Internet - WIRED - January 30th, 2020
- Startup MGZN The only Arab company on eSecurity Planet's Top 18 Cybersecurity Startups 2020 is this one! - Startup MGZN - January 30th, 2020
- Bitdefender wants to protect your device for just over 7 dollars, but there's a catch - TechRadar - January 26th, 2020
- How scammers take advantage of stressed-out taxpayers - The Guardian - January 26th, 2020
- Here's the Top Cyber-Security Software You Need To Consider Downloading For 2020 - Grit Daily - January 26th, 2020
- Limited internet to be restored in Kashmir, no access to social media - Reuters - January 26th, 2020
- Analyzing AppFolio (NASDAQ:APPF) and Cyren (NASDAQ:CYRN) - Riverton Roll - January 26th, 2020
- The Rise of the Internet of Things | 2020-01-20 - Security Magazine - January 25th, 2020
- Protecting Websites from Magecart and Other In-Browser Threats - Security Boulevard - January 25th, 2020
- Off-campus wireless internet security on par with University - Kent Wired - January 25th, 2020
- Jeff Bezos Phone Hack Should Terrify Everyone - The New York Times - January 25th, 2020
- Limited internet to be restored in Kashmir, no access to social media - WSAU News - January 25th, 2020
- Cyber Security Today Kids clothes site hacked, a new phony email extortion scam and be careful with Internet Explorer - IT World Canada - January 25th, 2020
- Experts write to government on cyber fixes - Economic Times - January 25th, 2020
- Internet Security Software Market by Types, Applications, Countries and Forecasts to 2026 - Vital News 24 - January 24th, 2020
- An Open Source Effort to Encrypt the Internet of Things - WIRED - January 24th, 2020
- Local News Role of the internet in human trafficking to be highlighted at summit in SLO - KSBY San Luis Obispo News - January 24th, 2020
- Global Internet of Things (IoT) Security Market | By Component,By Type,By Application Area Dagoretti News - Dagoretti News - January 24th, 2020
- Internet Security Market to Reap Excessive Revenues by 2026 Dagoretti News - Dagoretti News - January 19th, 2020