Cyber Security and the Internet of Things (IoT): Our Research Findings and Emerging Concerns

As Internet of Things (IoT) technology becomes more closely integrated in everyday systems, lifestyles and businesses, our research at NewSky Security has identified a rapidly expanding need for comprehensive cyber security measures. Cyber security encompasses all of the technology and operations employed to safeguard devices and their respective platforms and networks from cyber attacks or hacking. Similarly, IoT is the term used to refer to all of the objects and devices that are interconnected by one source: the internet. Establishing an internet connection between multiple devices facilitates the effortless accumulation and transmission of data wirelessly, all without mediation by humans. Yet when the IoT surrenders control to computers, it also opens a window for cyber attacks or other disruptive interventions that we’re seeing escalate in both frequency and sophistication.

Similar to how individual internet sites or databases can be hacked, the IoT also faces the risk of threats if cyber security is not properly employed. Through our ongoing research, we’ve observed that as newer devices and technology emerge and develop, the IoT subsequently expands at an unprecedented rate. IoT devices can range from technology as simple as smartphones and computers to complex air quality detectors, crash sensors or medical monitoring systems. These devices have become part of consumers’ everyday lives and have played an increasingly critical role in various industries, including defense.

The military relies heavily on information to carry out defense operations, motivating quick acceptance of IoT in the industry. Technology such as wearable devices, vehicles, weapons, sensors, robots and munitions have been integrated into the battlefield to coordinate an interconnected armed force. The Internet of Military/Battlefield Things (IoMT/IoBT) has become an essential apparatus in developing environmental awareness, evaluating risk and improving reaction rate. Even if not directly considered or interacted with, the IoT plays a major behind-the-scenes role in defense logistics, communications, data processing and operations. Our research indicates that if not carefully protected from hacking, these devices could reveal sensitive information regarding the inner workings of defense organizations, potentially posing significant national security threats.

Why is Cyber Security Critical in the IoT? Our Research Perspective

Our extensive research has confirmed that cyber security is essential in the IoT because one threat or hack could disrupt the network — or worse, give a cyber criminal complete access to the entire system. In industries such as defense or military operations, the IoT houses extremely sensitive information. If the IoT is accessed via a weak network point or vulnerable device, hackers then have the ability to retrieve intelligence or cause physical damage to the entire network.

While businesses, government and health care sectors have increasingly reaped the benefits of the IoT, this shift to interconnectedness also has raised the stakes in terms of risk and the potential financial and security damage that can occur from a hack. Our research shows that the more devices that are added to a network, the greater number of opportunities cyber criminals are granted for “entrances” to the data. This information in the wrong hands could incite serious damage in terms of defense logistics and national security.

One of the biggest problems with cyber security in the IoT that we’ve identified through our research is that most businesses or organizations are primarily focused on the convenience and cost-effectiveness offered by the technology and consequently neglect the associated risks assumed with a growing network. This leaves organizations that have excessive confidence and data in the IoT vulnerable to emerging threats we’re tracking.

IoT in the Defense Industry and Potential Threats: Our Findings

Although the IoT facilitates a swift decision-making and communication process in the defense industry, our research demonstrates that in order to be completely effective, it must be protected against evolving threat vectors. The IoT offers a variety of benefits in terms of maintenance, efficiency, economics and safety, and as quickly as it can improve defense logistics, it also can damage them. Through our analysis, we’ve identified that in defense organizations, three infrastructure types are typically targeted:

Building Infrastructure
Within and surrounding defense buildings, our research has identified that the main targets include security, electricity and environmental control systems. These systems are essential to the proper functioning of a defense organization’s base of operations and create the potential to inflict further harm to the system. Our findings show that cyber attacks on security devices in the IoT could pose a variety of threats, including the hacking of security cameras, prevention of authorized access to the facility or admittance of an adversary into the building. Likewise, the disruption of electricity and environmental controls has the ability to cause physical damage to the building, making it unsafe or unfit to work in.

Industrial Infrastructure
Our research confirms that cyber security is also essential to protect the defense industrial base as it is connected to the IoT. Production resources, the factory environment and computer-operated machinery are all connected by the IoT and can face detrimental consequences if cyber security is impaired. Attacks on any of these systems can interrupt or inhibit essential manufacturing, while causing defense organizations to spend a hefty amount in repairs. Overall, this can take a toll on military operations or defense procedures.

Communications Infrastructure
Lastly, our analysis shows that communications systems house large volumes of valuable information, making this infrastructure a common target in the cyber security realm. Attacks to devices such as routers, computers or phone systems pose a significant threat to organizations. In the defense industry especially, if an adversary were to gain access to the IoT through one of these mediums, this intelligence could quickly become a larger national security issue.

Cyber Security Practices to Protect the IoT: Our Recommendations

Based on our research at NewSky Security, proper cyber security depends on comprehensive risk mitigation. In order to prevent attacks to the IoT, organizations should update software regularly and “patch” devices to cover security gaps. This approach individually secures the devices to ensure the technology cannot be easily manipulated. Additionally, especially within the IoT, our findings indicate that it is critical that organizations avoid using generic passwords or the same passwords for multiple devices and systems. An extra level of security for logins and passwords can be provided by the use of multi-factor authentication.

Ultimately, our research supports that risk mitigation planning, such as monitoring for network intrusion or suspicious activity and developing action plans for cyber security emergencies, will better prepare the industry with safe IoT practices. Our ongoing studies continue to identify new vulnerabilities and threat vectors that organizations must address.

In all, the IoT can provide numerous benefits regarding cost and convenience for individuals, the private sector and the public sector. Consequently, along with these various tools and technologies and the increased flow of data between channels comes more susceptibility to threats that our research continues to track and analyze. Since these items are used consistently in day-to-day operations, the data that could be stolen from these networks provides sensitive, valuable information to hackers — especially in the defense industry. Our research emphasizes that individuals and organizations should take the appropriate preventative measures to mitigate cyber security risks and ensure devices in the IoT are operating in a secure network.