The term ‘IoT’ has become ubiquitous in everyday business conversation, as the Internet of Things has become integrated into our daily lives. As a result, IoT revenue is expected to grow rapidly, with IDC predicting worldwide spending on IoT software and hardware to grow from $726 billion in 2019 to $1.1 trillion in 2023. However, though the benefits and convenience of increasing IoT prevalence cannot be denied, neither can we ignore the inherent and manifold security risks that come with increased adoption.
IoT devices are smart but flawed with many lacking the necessary security to counter threats. These security vulnerabilities make them easy targets for malicious intent, with potentially dire consequences such as the Mirai botnet network that launched the largest DDoS attack ever recorded and incapacitated websites from Twitter to CNN to name a few.
Though incidents of this severity are not everyday occurrences, they serve to highlight the importance for companies interested in adopting IoT technology to weigh the benefits of building security from the ground up.
Costs and Benefits – IoT devices
From collecting valuable data for analysis to improved operational efficiencies and customer experiences, the benefits of integrating IoT devices into business operations is undeniable and it is no surprise that this is driving an invisible revolution of connected devices.
However, IoT devices have a well-documented catch – their security vulnerabilities, which pose major challenges for enterprises of all sizes. Nearly all respondents (97%) polled by Microsoft expressed security concerns when implementing IoT, and yet companies continue to integrate the technology without taking the necessary security considerations.
The reasons this happens are simple – enterprises embrace the opportunity and benefit of IoT devices, without adequately considering the risks involved with their integration.
Despite increasing IoT security incidents, many businesses weigh the short-term cost of building in security to their IoT networks and decide to omit it, without fully considering potential long-term consequences.
Others may consider IoT security but build it in as an afterthought – according to a 2018 survey by Trend Micro, 43% of IT leaders recognize that security is not adequately considered during implementation for reasons such as complexity, cost, and a lack of a universal standard.
However, security should be key to the IoT implementation process from the offset - building security controls into systems from the get-go is far more cost-effective than doing so later in the development cycle, or after a vulnerability occurs or becomes public.
The challenges of IoT security
It is understandable why businesses may find IoT device security a challenge. The ubiquity and fast growth of IoT popularity has led to a fragmented IoT landscape with a lack of well-defined and agreed standards. With ten ongoing and different initiatives to define standards and frameworks for IoT devices, businesses may struggle with the challenges at hand.
Another challenge that businesses face comes from a limited internal understanding of IoT security. IT leaders with an IoT skillset are a limited resource, as a result of the relative novelty of IoT technology – meaning a good number of companies simply do not have the in-house expertise to evaluate and roll out security measures for their IoT devices.
Lastly, businesses may struggle with the implementation of security patches for reasons such as complexity or cost. Many IoT devices at the edge run on low power – sometimes even battery or solar power, meaning security patches need to be seamless and easily implemented.
This is further complicated by the cost factor – with these devices often costing very little, security solutions need to be cost-effective and scalable at size in order to be viable for businesses to adopt.
How to approach IoT security
With this in mind, how can companies approach their IoT security challenges? While the balance between the trade-off of security and cost are hard to manage, it is still necessary for companies to make security a standard from the outset, instead of an afterthought.
Enterprises should be looking to evaluate security as a process and not a product or an option while prioritizing it as an item in budgets in order to reap the benefits of IoT.
With the complexities of IoT security presenting a challenge, and with a security skillset as a resource being hard to find, companies can explore secure software libraries as a security option. By consulting with a qualified expert, secure software libraries offer a middle ground between hardware and software security, allowing for the crucial management of edge devices with end-to-end security.
This is how enterprises may be able to secure their IoT presence affordably and at scale, countering the serious risks of unsecured IoT adoption while reaping the rewards that they can offer.
As incidences like the Mirai botnet attack demonstrate – it only takes one vulnerability for enterprises to be exposed, and as IoT becomes only more prevalent, businesses need to be taking active steps to protect their IoT infrastructure.
