7 Recommendations for IoT Manufacturers for Product Security

This article first appeared on IoT for All here.

Most IoT security breaches are preventable. Look at any high-profile IoT attack and you’ll find a known security flaw.

• The Ring smart camera breaches of 2019? Users were allowed to create weak passwords and skip multi-factor authentication.
• The Verkada surveillance service attacks of 2021? The company’s system had too many super-admin roles, virtually ensuring powerful credentials would leak (which they did).
• The infamous Mirai botnet of 2016? It worked by exploiting common passwords for IoT devices.

A few common-sense policies would have prevented all three of these attacks.

In other words, if you develop IoT products—or manage their operation in the field — security best practices are worth your time. After all, IoT malware attacks increased by a whopping 400% in 2023 alone.

Of course, IoT security isn’t a task you do once and consider complete. It requires vigilance for the whole lifespan of your products. Such ongoing security monitoring is called vulnerability management, and it’s the key to keeping your users safe.

7 Best Practices for IoT Security

We get it: security can be costly, time-consuming, or simply annoying. That’s why IoT vendors sometimes fail to give security the attention it deserves. Just remember that a disastrous attack can cost your company a lot more than any security investment—up to and including your brand itself.

The IoT industry has come up with many best practices over the years, and vulnerability management platforms can help you put these (and other) security protocols into effect.

So don’t be intimidated by IoT security. Just start following these seven recommendations today.

1. Secure all communication channels.

Maybe your IoT device sends data to the cloud. It could trade data with other devices. Perhaps it does both. No matter where data goes, however, the pathway must be protected from third-party interception.

The way to harden these channels is to use encryption—but not all encryption methods are strong enough to trust with your user data. Look for the most optimal combination of different security algorithms, a cipher suite. Avoid the temptation to stick with older, deprecated security protocols, even if updates require a little more work to integrate with older devices and applications.

2. Ensure robust authentication and authorization.

Your IoT system needs a way to tell who’s who; that’s authentication and it’s usually accomplished with usernames and passwords. The system also needs a way to determine what a given agent can do; that’s authorization, which boils down to permissions.

Harden authentication by requiring users to set up multi-factor authentication (MFA) using second devices, biometrics, location/time-based identifiers, one-time passwords, or other methods.

Harden authorization by implementing role-based access control (RBAC) in your IoT management platforms, and limit admin access to the minimum necessary users.

3. Follow secure coding practices.

Vulnerabilities can sneak into your device’s firmware, your system software, or both. If attackers access your source code, they can find vulnerabilities to exploit. Even worse, they can alter the source code without your knowledge, building backdoors you won’t know about until it’s too late. So secure coding requires strong standards of practice and a safe development environment.

Make sure your libraries and frameworks are secure before building with them. Then subject your code to ongoing security tests. Luckily, you can automate this process. Use a firmware analysis platform to discover zero-day vulnerabilities before the attackers do.

Unfortunately, you don’t just have your code to worry about. Most IoT systems incorporate third-party components, too. You can’t necessarily prevent someone else’s vulnerabilities. The next item on our list is your best bet for safely using third-party components.

4. Keep all components up to date.

Hopefully, the vendors you work with are also investing in IoT security. (If not, we’d recommend finding a new vendor!) They’re constantly creating patches and bug fixes to plug the holes in their product’s security.

These protections won’t work unless you update the software, though. So be sure to do that every single time you can. In addition to keeping all your software components up to date—all the time—encrypt all firmware updates to make sure malicious actors don’t modify them on the way.

5. Never let a default password anywhere near your system.

Don’t ship products with default passwords. Don’t let users set up default—or common, or recycled—passwords. Attackers love predictable passwords, so do whatever it takes to keep them out of your system.

Ship devices with strong, unique passwords, then prompt users to create similarly strong passwords on first use.

6. Encrypt data at rest.

Remember how we recommended TLS data encryption for all communication channels? You also need encryption for data that’s not moving.

Perhaps you store user data on the device. You might store it in the cloud. Maybe you even have your own servers. It doesn’t matter; encrypt that data. It’s essential that you only use strong encryption keys, however, especially if you store data on your own hardware.

Weak encryption can be cracked, and offline attacks—such as stealing data from an IoT camera’s SD card—are even easier. Encryption keys may be your last line of defense, so make sure to keep up with advances in cryptography and stay up-to-date with the latest recommendations.

7. Execute an ongoing vulnerability management plan.

The thing about cybercriminals is that they’re always innovating. As an IoT vendor, it’s your job to stay as many steps ahead of the attackers as possible.

That’s what vulnerability management is for. There are a few ways to go about it:

• Regularly test devices for zero-day vulnerabilities - avoid having these types in your products.
• Create a software bill of materials (SBOM) to keep track of third-party components.
• Run a vulnerability disclosure program (VDP) to get help from the security community.
• Implement an organized system for reporting, assessing, and remediating vulnerabilities quickly—ideally, before attackers can act.

Sounds like a lot, doesn’t it? With the right tool, however, vulnerability management becomes manageable. That tool is called a vulnerability management platform (VMP).

That said, vulnerability management is a deep topic, and we’ve only skimmed the surface here. If you need support with vulnerability management, book a call with us, and let’s discuss your next steps.