A Comprehensive Guide to IoT Security

Share This

As digital transformation fuels the proliferation of unmanaged devices across industrial environments, having a strong IoT security program in place has become vital to protect critical infrastructure from cyberattacks.

Table of Contents:

  1. What Is IoT Security?
  2. Why Is IoT Security Important?
  3. High Profile IoT Cybersecurity Attacks
  4. What Makes IoT Security So Challenging?
  5. IoT Security Guidelines & Best Practices
  6. Resources for Cybersecurity Practitioners

What Is IoT Security?

The Internet of Things, also known as IoT, is a system of interconnected computing devices, mechanical machines, or objects with sensors and software that can transfer or exchange information over a network with no human intervention. IoT security refers to the processes and technologies put in place to prevent or mitigate cyber risks for these devices.

The definition of what constitutes an IoT device varies widely and includes everything from biomedical implants to sensors on manufacturing and electrical equipment. An industrial ecosystem can encompass many different smart devices that collect, send and act on data from their environments. Sometimes, these devices even communicate with each other and act on the information they get from one another. These devices typically share their data via a gateway or other edge device where it is then either sent to the cloud for analysis or analyzed locally. Regardless of whether something is classified as an IoT, OT or IT device, it needs protecting to maintain operational resilience.

The figure below is helpful to understand the differences between the different types of devices.

IoT Device Flowchart
 OT vs. IoT vs. IT devices

Why Is IoT Security Important?

Industrial and critical infrastructure operators are rapidly deploying billions of devices to optimize their automation processes using the data provided by these “things”. Unfortunately, this trend is creating new cybersecurity risks, as these devices open up to networks, both public and private. These endpoints have become low-hanging fruit for attackers who want to compromise operational processes and maximize the economic benefits of a cyberattack.

The image below offers a breakdown of how these devices are used in our daily life. Although different organizations use these technologies for different use cases, keeping them cyber resilient should always be a priority. The impact on critical infrastructure environments can be particularly devastating when you consider what might happen if the electric grid was compromised or life-saving devices in a hospital were interfered with.

IoT devices in everyday life
IoT devices in smart cities

High-Profile IoT Cyberattacks

From thermostats and sensors to cameras and process controllers, IoT security challenges lie everywhere, and the theoretical threat has already become reality. In October 2016, the largest DDoS attack in history occurred, the Mirai Botnet Attack. This attack left much of the United States East Coast without internet. Attackers scanned the internet for open Telnet ports, and using default passwords, successfully compromised large swaths of CCTV cameras and routers which were then used as a botnet army.

Variants of this malware still exist today and are being closely monitored by the Nozomi Networks Labs team.

Nozomi Networks

Labs Blogs

  • Be on the Lookout for These New Cybersecurity Threats in 2023
  • How Botnets Evade Detection and Analysis
  • New Report: Ransomware, Vulnerabilities and Security Threats

In 2017, hackers used a fish tank thermometer to steal 10 gigabytes of data from the North American casino that had just installed it. Because the fancy thermometer was Wi-Fi enabled, threat actors were able to pull the casino’s database of high rollers across the network and extract it through the thermostat. Ultimately, this device acted as a gateway to the rest of the datacenter, which contained sensitive personal and financial data and applications.

In March of 2021, Verkada, Inc., a security camera company, fell victim to an attack which exposed live feeds of 150,000 surveillance cameras inside hospitals, manufacturing facilities, prisons and schools. The attack was not technically complex. Bad actors used cloud server to gain access to legitimate credentials which allowed them to access the surveillance cameras deployed at thousands of customer sites.

Podcast Episode

The Verkada Camera Attack – How Did Hackers Get In?

In this short episode, find out what happened during the recent security breach, and what common practices can open the door to attacks like this.

What Makes IoT Security Challenging?

1. IoT Devices Are Typically Unmanaged and Insecure by Design

After an initial deployment, IoT device software is rarely updated, if even possible. This is particularly true of firmware, where many of these vulnerabilities live. Because of this, these devices remain vulnerable to attacks that can easily be prevented for other types of managed devices.

2. Weak Identity and Access Control Measures

The use of default passwords and a lack of strong authentication procedures makes compromising these devices much easier than a managed IT device.

3. Connected IoT Devices Become Easy Entry Points

IoT devices typically connect to an ecosystem that includes business applications, data centers, IT infrastructure, and the cloud. Because they lack strong cybersecurity controls by default, this makes them easy targets for hackers to use for entry into the rest of the network.

4. Lack of Network Segmentation

Large scale industrial internet of things deployments don’t easily lend themselves to the level of network segmentation needed to mitigate cyber threats or prevent the spread of malware.

5. Inability to Install Agent-Based Security Software

The vast majority of IoT devices being released are incapable of hosting software security agents.  We have no problem installing agents on Windows/Mac/Linux based operating systems, however IoT devices have very different and functionally reduced operating systems.  This is generally because they have limited processing and communication capabilities, in addition to not having “space” to install such bulky software.

6. Rogue Deployment of IoT Devices

IoT devices are often deployed without the involvement of IT and/or cybersecurity teams. This can result in devices being located in sensitive or insecure areas of the network, making them much easier compromise because of the lack of additional cybersecurity layers.

Nozomi Networks

IoT Security Solutions

Having an IoT security strategy is an integral part of digital transformation and process automation for critical infrastructure companies. Learn how Nozomi Networks’ solution reduces cyber risk.

IoT Security Guidelines & Best Practices

Although there is no regulatory body responsible for the cybersecurity of IoT devices, there have been a handful of attempts at the Federal level to strengthen security practices for them. The National Institute of Standards and Technology (NIST) established their NIST Cybersecurity for IoT Program in 2020, whose mission is “to cultivate trust in the IoT and foster an environment that enables innovation on a global scale through standards, guidance, and related tools”, which you can read more about here.  

The NIST Cybersecurity Framework (CSF) is a risk-based framework that helps organizations manage and protect their critical infrastructure and data. The CSF provides a common language and set of guidelines for understanding, managing, and communicating cybersecurity risks.

Using the NIST Cybersecurity Framework as a guide, we’ll go through some best practices for IoT device security.

NIST Cybersecurity Framework functions for IoT security
The 5 Functions of the NIST Cybersecurity Framework

1. Identify

Understand the types of IoT devices in use in your organization and their associated risks. This includes determining the types of data that the devices collect and transmit, as well as the potential impacts of a cybersecurity incident.

An asset management mechanism that can track every connected device with real-time data, including zone and network location data, lifecycle, and patch information, is a critical component of this step.

2. Protect

Implement appropriate security controls to protect your network from threats. This includes measures such as a firewall capable of isolating or killing connections that are associated with malware or other anomalies. It can also include security controls like network segmentation, MFA and encryption.

Establish a process for network security engineers to follow to patch the highest risk and most vulnerable assets first, to reduce overall risk exposure and increase resilience.

3. Detect

Implement monitoring and detection mechanisms to identify potential cybersecurity threats and vulnerabilities. This may include network monitoring, log analysis, and security incident and event management (SIEM) systems.

Utilize an industrial network monitoring solution that can integrate with network access control (NAC) products and expose the greatest potential risks in real-time. For example, one that directs the NAC to place critical or vulnerable assets into dedicated VLANs—capable in a DMZ configuration.

4. Respond

Develop and implement a plan for responding to cybersecurity incidents, including procedures for finding and isolating affected devices and systems and communicating about the incident to relevant parties.

Leveraging comprehensive incident response playbooks and tools for forensic analysis can help achieve this quickly and efficiently.

5. Recover

Plan and exercise business continuity strategies for recovering from cybersecurity incidents, including procedures for restoring affected systems and processes and mitigating any potential impacts.

Other best practices include collaborating with industry partners and government agencies to share information about cybersecurity threats that affect IoT devices and continuously reviewing and improving your cybersecurity procedures to ensure they’re effective and aligned with the evolving threat landscape.

Nozomi Networks

Army of the Undone: Securing IoT Across Critical Sectors

Learn which compensating controls are most effective for securing IoT devices.

Cybersecurity Resources

Although securing IoT is a complex challenge, it’s too important to ignore. That’s why we’ve created our resource library which provides guidance and solutions for today’s biggest cybersecurity challenges. We hope these resources provide you as a security professional with the right information to support your overall cyber resilience strategy.

Executive Brief

Closing IoT Security Gaps in Your Operations

Learn more about today’s visibility, monitoring and security challenges and how to solve them.


In the World of Unsecure IoT – Is Privacy Dead?

Watch our esteemed panel of experts discuss data privacy across smart cities and IoT infrastructure – who says privacy is dead?

Security Report

Security Research Report — 2022 2H

A Deep Look into the ICS Threat Landscape

Exclusive Nozomi Networks data on critical intrusion alerts and common malware categories affecting industrial organizations around the world.

Ready to anticipate, diagnose and respond to cyber risks? Learn more about our IoT security solution, Vantage here.

Let's get started

Discover how easy it is to identify and respond to cyber threats by automating your IoT and OT asset discovery, inventory, and management.

Vantage IQ

The next generation of AI-powered analysis and response for critical infrastructure and industrial operations.   Register for Preview Event