{"id":42707,"date":"2015-04-14T17:13:08","date_gmt":"2015-04-15T00:13:08","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=42707"},"modified":"2025-06-08T19:13:55","modified_gmt":"2025-06-09T02:13:55","slug":"verizon-report-foreshadows-breaches-originating-with-iot-devices","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/verizon-report-foreshadows-breaches-originating-with-iot-devices\/","title":{"rendered":"Verizon Report Foreshadows Breaches Originating With IoT Devices"},"content":{"rendered":"

This blog post was written by Rick Simon.<\/em><\/p>\n

Today, Verizon released its 2015 Data Breach Investigations Report<\/em> <\/a>(DBIR).<\/p>\n

As Verizon noted in the Appendix D discussion of the security of the Internet of Things, most of the examples of IoT device-originated breaches have been proofs of concept\u2014so there were few incidents and little data disclosure to report for 2014. As a result, there is no Verizon \u201ccommon incident pattern\u201d for IoT device breaches\u2014yet.<\/p>\n

But for those who work in incident response and information security, we know it is simply a matter of time until a large-scale IoT device-originated breach occurs with broad-based ramifications.<\/p>\n

The IoT device security challenge<\/strong><\/h2>\n

IoT devices pose a particular challenge that is not typical in new technology markets. IoT devices are by definition connected to one type of network or another, so they are windows into that network, which leads to the obvious question: Are the windows open or closed?<\/p>\n

Further, many IoT devices sense and send information\u2014from personal to critical infrastructure to military\u2014that in the wrong hands poses a significant security risk.<\/p>\n

Today and in the days ahead, we will explore why IoT devices are exposed, IoT device attack surfaces, what types of IoT device-originated breaches we expect to see in the intermediate term, and things businesses can do to prepare for the onslaught of IoT devices in their trusted networks.<\/p>\n

What are the forces that expose IoT devices?<\/strong><\/h2>\n

Emerging market that is not well-understood<\/em><\/p>\n

Today, a person with a good idea can purchase a $20 microcontroller, download sample code into a beginner-friendly development environment, and create a working prototype of an IoT device that can be put on sale on popular crowd-funding sites. The code may never be inspected and the hardware may never be security tested, but these devices could end up on networks in early adopter homes and business.<\/p>\n

The low cost and accessibility of these IoT device building blocks by individuals without formal software development experience have led to a proliferation of neat but unsecure devices. Further, there is little understanding of the implications of that insecurity.<\/p>\n

IoT device cost pressure<\/em><\/p>\n

When developing IoT devices that are meant to be purchased by the millions, cost is particularly important. Every additional bit of main memory or flash storage adds cost. Additional processing power adds cost. Software to protect the device adds cost. As a result, IoT device developers look to create devices that deliver the minimum required functionality at the lowest possible cost.<\/p>\n

Many IoT devices have simple tasks: reading a sensor value, flipping a relay on or off to activate another circuit, or exchanging information with a gateway or application controlling the device. Because these tasks are often simple and cost is so critical, these devices are generally developed to run lightweight operating systems and applications on inexpensive 8-bit microcontrollers that are limited in capacity and processing power.<\/p>\n

But how does a developer include SSL encryption on an 8-bit microcontroller that is simply turning lights on and off? Does it even need encryption? How can a million such devices be cost-effectively updated for security reasons when there is so little capacity on the embedded ROM that physical access to the device is required to perform the update?<\/p>\n

Although questions like these may not concern an IoT developer trying to get a product out the door, these questions become critical if the device is used to control all of the LED streetlights in a city or used in a water treatment plant to turn pumps on and off after reading sensor values from a different IoT endpoint.<\/p>\n

IoT device time-to-market pressure<\/em><\/p>\n

When a budding entrepreneur or a large enterprise detects an IoT market opportunity, a basic question they must answer is \u201cHow fast can we get to market?\u201d<\/p>\n

In the IoT space, a rich environment of sample code, tutorials, and libraries can accelerate time to market. Although there is good guidance for securing TCP\/IP networks, there is little security guidance for the proliferation of network protocols used by many new IoT devices. For example, mesh networks like ZigBee, ZWave, RF, iBeacon, and Bluetooth LE are being bridged (connected, multihomed) to current TCP\/IP networks by these IoT devices directly or through a gateway, thereby opening a window to attackers.<\/p>\n

Furthermore, the IoT developers primary focus, especially in the early market phase, is to deliver the IoT device\u2019s basic functionality. Security of that new device is secondary. And when they do get around to addressing security issues in a meaningful way, many developers have limited understanding of secure coding practices, especially for this new industry.<\/p>\n

Need for IoT device simplicity<\/em><\/p>\n

There is an overwhelming need in both consumer and business environments to build IoT devices that are simple to operate and maintain and can live in perpetuity, gathering information and sending it to other systems in the network.<\/p>\n

To reduce or eliminate maintenance, many IoT devices are designed to not allow software or firmware updates. Yet they are network-capable devices communicating on the same subnets as other sensitive information. Network-capable devices that cannot be updated but proliferate exponentially on networks eventually become open windows for the bad guys to exploit.<\/p>\n

Focus on functionality, not security<\/em><\/p>\n

When discussing the virtues of an IoT device, salespeople inevitably focus on its key benefits:<\/p>\n