Security specialists from Check Point delve into the risks associated with Internet of Things (IoT) security and strategies for getting ahead of potential threats.

Eyal Manor, who leads IoT, Threat Prevention, and Security Management Product Management at Check Point, and Oded Vanunu, Chief Technologist for WEB 3.0 and Head of Product Vulnerability Research, engage in a discussion with asmag.com regarding the implementation of security measures in IoT products by manufacturers and users.

Q: What is the most significant gap in IoT cybersecurity management?

Manor identifies a significant gap in the urgency and priority given by organizations to address IoT vulnerabilities. Organizations often overlook the extent of their IoT device inventory and the security measures required for these devices. While tools for securing these devices exist, the lack of awareness and prioritization remains a substantial challenge. Even when companies recognize the importance, operational challenges such as updating passwords, patching, and discovering all connected devices often delay necessary actions.

Manor emphasizes the necessity for companies to adopt a higher level of awareness and attention towards IoT and mobile devices, as these are prime attack vectors. Regulation plays a crucial role in driving this awareness, as exemplified by GDPR and the U.S. Cyber Trust Mark initiative under the Biden administration.

Q: How does Check Point address IoT security?

Manor explains that Check Point aims to provide seamless and streamlined security for IoT devices. Recognizing the difficulty in tracking all devices within an organization, Check Point leverages existing network security appliances to identify and monitor devices, detecting and blocking any anomalous behavior. This approach helps bridge the gap between the organization’s needs and the challenges of managing device security effectively.

Q: What are the emerging IoT security challenges that the industry should anticipate?

Manor points out that attackers are increasingly targeting IoT devices due to their large numbers and the relative ease with which they can be exploited, aided by AI. IoT devices often lack robust security measures, making them vulnerable to exploitation by attackers with minimal effort. Additionally, manufacturers typically prioritize cost and speed to market over security, leaving devices open to supply chain attacks.

Q: What role do regulations and standards play in ensuring IoT security?

Oded Vanunu, with 22 years at Check Point, underscores the importance of ensuring the integrity of IoT devices from the manufacturing stage. Regulations should mandate cryptographic signing and tamper-proofing of devices, ensuring they are secure before deployment. Regular updates and patches are essential to maintain ongoing security.

Q: What are the fundamental principles of IoT cybersecurity?

Vanunu advocates a layered security approach to IoT devices, beginning with embedding security at the hardware level by the manufacturers. Network-based security solutions should monitor for malicious activities at the software level. Access control is also critical, ensuring that only authorized individuals have access to the devices and the network they are connected to. Integrating these devices into the broader security framework of an organization is crucial for maintaining overall security.

Q: What strategies do you suggest for securing IoT devices, especially those that can’t be updated or replaced?

Vanunu emphasizes the importance of controlling access to IoT devices and maintaining awareness of their presence within a network. Simple actions like enabling two-factor authentication, changing default passwords, and avoiding external exposure can significantly enhance security. Despite manufacturers often neglecting cybersecurity, basic security practices can mitigate many risks.