Security

How the Internet of Things Can Impact Agency Security

The Internet of Things has far-reaching security implications for agencies that don’t assess threats and vulnerabilities.

Karen Scarfone

Karen Scarfone is the principal consultant for Scarfone Cybersecurity. She provides cybersecurity publication consulting services to organizations and was formerly a senior computer scientist for the National Institute of Standards and Technology (NIST).

Federal agencies use commercial, off-the-shelf Internet of Things devices for nearly every purpose imaginable, from medical devices and virtual reality goggles to environmental sensors and HVAC systems. IoT devices support automated interactions with the physical world, offering functionality that wouldn’t otherwise be possible. Unfortunately, like other technologies, these devices are susceptible to cyberattacks, and the technology has evolved so quickly that cybersecurity has not kept pace.

In the past few years, we have become mindful of the risks of IoT devices, particularly their potential to reduce human safety and their tendency to lack cybersecurity capabilities that other technologies support. To address these concerns, Congress passed the IoT Cybersecurity Improvement Act of 2020. The law requires federal agencies to meet minimum cybersecurity requirements for their IoT devices, with each agency identifying its own requirements in accordance with the National Institute of Standards and Technology’s Special Publication (SP) 800-213.

Security measures may differ from one IoT device to another and even for a single type of device if it’s used for multiple purposes. That said, here are the high-level principles that every agency should follow.

Click the banner below to get Insider access to exclusive security articles.

Identify IoT Risk with Threat Modeling

Even in small numbers, IoT devices can affect an agency’s risk significantly and in numerous ways. Devices increase the attack surface, giving attackers more ways to enter networks and environments. Because devices interact with the physical world, attackers could misuse them to disrupt agency operations, cause harm to people, damage infrastructure or steal sensitive information collected by IoT device sensors.

Agencies should perform threat modeling to better understand the relevant risks and mitigations for their IoT devices. This doesn’t mean modeling for every IoT product. Instead, think broadly about likely threats, likely vulnerabilities in those devices, the potential impacts of compromises and security controls that could help mitigate risks.

During threat modeling, agencies should review recent cyberthreat intelligence regarding how IoT devices have been attacked and compromised. Keep the following points in mind:

IoT devices often function as part of a larger system; for example, interacting with the device manufacturer’s cloud-based software, services and data storage. This means sensitive data collected or used by the agency’s IoT devices might be accessed by and stored with one or more third parties. Make sure to include them in any threat modeling.
IoT devices are frequently placed in locations that are physically accessible to attackers. Accordingly, threat modeling should assess the risk of local attacks against such devices, such as insertion of removable media, device theft, hardware tampering and wireless attacks.
Employees might use some IoT devices personally, introducing risks related to personal information and privacy. For example, devices might record audio or video of employees or capture vital signs and other health information. Be mindful of both intentional and inadvertent recording of such data.

Determine the Best Risk Mitigation Strategies for Your Agency

Risk varies enormously among IoT devices. Consider the relative risk of a small gadget on an internal IoT-only network versus a lifesaving medical device in a hospital emergency room. If an IoT device is regulated, agencies must comply with all pertinent regulations. For other IoT devices, consider any applicable requirements of the NIST Cybersecurity Framework and the NIST Risk Management Framework, as well as the guidance in SP 800-213 and the control catalog in SP 800-213A.

Typically, it’s not feasible to apply a single set of cybersecurity requirements across all IoT devices. Supported capabilities vary from device to device, and missing capabilities usually can’t be added in the same way we might install anti-virus software on an operating system. Also, using an IoT device in one manner may create risks and impacts that don’t exist when the same device is used differently. As a result, the necessary mitigations can vary by use case.

In general, it’s prudent to take advantage of devices’ built-in cybersecurity capabilities, but be prepared to take additional steps to mitigate risk. For example, use separate networks for IoT devices and employ boundary protection devices — such as IoT hubs, gateways or firewalls — to restrict network traffic to and from the devices. This makes it harder for attackers to access devices and easier for agencies to monitor devices and detect suspicious activity. Having separate networks and placing IoT devices behind boundary protection devices are especially important if the devices can’t be updated or patched.

EXPLORE: How to keep mobile technologies safe with adaptive protection and device control.

Add Cybersecurity Protection or Retire Devices as Needed

Ideally, manufacturers will support IoT devices throughout their lifespans, releasing patches to correct vulnerabilities and taking other steps to address security issues. Realistically, however, some devices will not be supported. Agencies should be prepared to mitigate cybersecurity risk, preferably proactively, for legacy IoT devices.

Think in advance about how to compensate for problems in unpatchable devices — for example, a new OS vulnerability or a newly discovered weakness in a cryptographic algorithm used to protect data. Threat modeling should include these types of scenarios, then identify multiple ways to address them proactively, such as deploying network-based security technologies in proximity to vulnerable devices to monitor them closely.

In addition, agencies should determine criteria for deciding when a vulnerable legacy IoT device carries too much cybersecurity risk to be kept online. Remember, most IoT devices are intended to have relatively short lifespans, so planning for their retirement and replacement should be part of any security strategy.

katleho Seisa/Getty Images