A recent trip landed me in Denver International Airport. As I scanned the screens that show arrivals, departures and luggage carousels my mind strayed to connectivity. Not just the routing of humans from one plane to another or in reuniting them with their luggage, but connectivity that we use for the IT network. The Internet of Things (IoT) was staring back at me, showing me the connected path of airplanes, people, restaurants, you name it. It’s truly making lives better.
I was reminded by a co-worker that it is even helping doctors to wash their hands. Hospitals now have IP connected sinks that monitor how long hands are being washed. Sanitary reporting and metrics are now being tracked digitally, in databases, over time. Epic.
The downside? As each new device connects to the network another vulnerability is created. Recent headlines show the latest vulnerability is a dishwasher that has a built-in web server. The vulnerability is very specific:
- Have access to the system via a network interface (wired or wireless will get you there)
- Take advantage of “directory traversal” to elevate privileges and use the webserver now to attack others
Star Wars reference coming [cue theme song]… It was a simple vulnerability that took down the Death Star. One system had access to everything. This time it’s a dishwasher.
The best way to deal with these kinds of vulnerabilities? First, visibility to know what is on your network. Second, keep the IoT devices segmented and continuously monitor their post-connect activity. Review constantly. Does the profile change? Does the IoT device start making calls? Does any desktop system on the network actually need access to a dishwasher web server? Probably not. Third, you need to block the devices using Access Control Lists (ACL’s) or leverage strict firewall rules. Finally, make sure to automate this process for role assignment and monitoring.
Good best practices for all IoT devices.
And don’t make the sink tell on you – wash your hands.