“We have met the enemy and it is us,” says Laura DiDio, Strategy Analytics director of Enterprise Research and Consulting.
A 56% majority of corporate enterprises rank careless end users constitute a bigger threat to corporate IoT security than the combined danger of an edge/perimeter attack and internal security breach by company insiders.
Those are the results of Strategy Analytics 2016 IoT Security Threats and Trends Survey which polled 600 corporations worldwide during November and December 2015.
The Internet of Things (IoT) offers greater opportunities but in interconnected environments, the security risks increase exponentially and the attack vector or surface is in theory, potentially limitless. The survey responses indicate that corporations are confronting an IoT security threat landscape for which they may be woefully ill-prepared.
Among the top survey findings:
- Majority of companies spend little time on security. A 70% majority of survey respondents spend 0% to 20% of their time on securing their corporate and IoT networks. The survey data indicated that only a seven percent minority of company IT departments devote over 50% of their time to security. Among the companies that allocate a majority of their time to safeguarding the corporate data assets, over two-thirds of those organisations are in Banking/Finance, Government, Defense and Aerospace vertical market segments, according to SA’s survey responses.
- IT security spending varies widely. The amount of money corporations spend on securing their corporate and IT Security spending varied widely. Tellingly, the largest segment of participants – 40% – was unsure how much their companies spent annually safeguarding the corporate data assets. A 19% minority spend $1 to $20 million annually on security while 11% spend less than $100,000 and 20% reported they do not have a separate IT security budget. The remaining 13% of respondents spend between $101,000 and $999,999 annually on security hardware, software and services.
- End users constitute biggest threat to IoT security. A 56% majority of respondents said the biggest security threat to their IoT networks was “end user carelessness” followed by 42% who cited “malware”; 32% who said “spyware” and 25% who said Mobile and BYOD devices.
- More companies experience Hhcks. One-third – 31% of participants said their firms had experienced a hack within the last 12 months vs. 39% that said “No.” However, 25% of participants said they were “Unsure” if their companies had been hacked and the remaining 5% said “they had no way of knowing!”
- Risky business: 44% of Firms that experienced a security hack were unable to determine the source of the hack, the type of hack or the duration or severity of the hack which puts the business at elevated and extreme risk for a repeat attack. It also indicates that the organisation is unaware of what is going on within its own network. This means that hackers can potentially invade the network and steal, change, hijack valuable data and Intellectual Property without the company’s knowledge and also use the corporate IoT network as an entry point/gateway to other connected partner ecosystems.
- Denial of service attacks proliferate. DoS attacks at the network, physical and application layers and end user carelessness & failure to turn on security are the most likely causes of successful security hacks. However, in a worrisome trend, nearly four-in-10 businesses – 38% – of survey participants acknowledged they were unable to determine what type of hack their firm had experienced. This means the company also lacked other vital information and it’s likely their data assets, Intellectual Property (IP) and data privacy could have been compromised or stolen without their knowledge. Consequently this places the business, its ends users, customers, business partners and suppliers at increased risk of vulnerability and leaves it open to further security breaches.
- Few firms successfully detect, repel security attacks. Only six 6% of businesses said they were able to detect and thwart breaches in advance of a successful penetration that disrupted the network or resulted in damage or lost data.
Conclusions
IoT is a disruptive technology. It is complex and challenging. Although many aspects and components of IoT are in use today, IoT security and data privacy will demand that vendors, OEMs and corporate end users step up their game with respect to security and data privacy.
Once again, in a world where devices, applications and people are increasingly interconnected, the attack surface is potentially limitless. Organised hackers have become more proficient and the hacks more pervasive and pernicious. Corporations must be proactive and not reactive with respect to security. The corporation ultimately bears responsibility for the defense of its data and Intellectual Property.
Ask yourself: how much risk can you tolerate? How much loss can you sustain? What have you got to lose?
Laura DiDio is Strategy Analytics director of Enterprise Research and Consulting.
Comment on this article below or via Twitter: @IoTNow_ OR @jcIoTnow
