Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/30/2020
02:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
50%
50%

How to Secure Your IoT Ecosystem in the Age of 5G

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface.

The Internet of Things is becoming an integral part of business and daily life, affecting everything from monitoring products in a warehouse to tracking your heartrate and sleeping patterns. Gartner predicts that by the end of this year, 5.8 billion enterprise and automotive IoT endpoints will be in use. And now, with deployment of 5G on the horizon and the massive expansion of IoT devices, a new security challenge is emerging.

For businesses planning to adopt 5G, the sheer number of IoT devices creates a much larger attack surface. In a recent study by AT&T Cybersecurity, 44% of respondents stated this was their top business concern when it comes to 5G, while 39% identified the increase in connected devices to the network as their top concern. The number of connection points to the network, human and machine, will create new opportunities for bad actors to weaponize currently known manageable threats. 

While 5G is inherently more secure with its built-in security measures (including network slicing, stronger over-the-air encryption, subscriber identity protection, and reduced risk of eavesdropping) to address many business needs, enterprises should be proactive in adjusting their security policies and controls. Here are four tips for organizations to keep their networks safe in this new 5G connected world.

Adopt virtualized, automated security controls 
This will help organizations manage the expanded attack surface and mitigate future risk. Virtualized security can be deployed quickly and allows organizations to respond immediately to new attacks with an automated response such as creating a firewall. 

Implement machine learning and threat detection
You're going to need to be able to better monitor and analyze the increased amount of activity across your network. Machine learning and automated threat detection are necessary, since manual intervention will no longer be able to sift through and react to the amount of data 5G will bring.

Consider a zero-trust approach
Using zero trust for identity and authorization across all devices in your organization lowers the possibility of the introduction of malware on the network. By continually checking a user’s presence and behavior, a zero-trust model will help your security team quickly determine whether the user is human or machine.

Embrace a shared security model
IoT devices will continue to have vulnerabilities, such as factory-default passwords remaining in production, and organizations will need to take responsibility for safeguarding against rogue devices. Just as in the public cloud, a shared security model for 5G will help providers allow for security in the infrastructure by using the network itself as a security tool, while organizations tackle the endpoints.

In a shared security model, the enterprise would assume responsibility for devices on the network. And, with 5G, the network operator is responsible for the elements of security listed out in 3GPP frameworks and standards (i.e. data encryption and radio access network) as well as  handling the security of the network infrastructure itself, while the enterprise would assume responsibility for devices on the network including mobile device management, certification of applications that the enterprise runs on the network, and identity and access management.

With the influx of devices connected to 5G, adopting a holistic, multi-layered approach will be key to helping protect your IoT ecosystem and other valuable assets. Every organization’s IT and security infrastructure has a different design, which also means each organization’s security needs will differ. A factory floor, for example, that uses a number of industrial IoT devices to produce automobiles will have different security measures than a life-sensitive device, like an insulin pump, that is dependent on remediation and response plans. Even if someone is accessing the data, the device would not want to be disabled.

While there are controls to help prevent end devices from infecting carrier 4G networks, a single device has been known to impact enterprise networks. In 2018, hackers used a smart fish tank in a Las Vegas casino to access and move laterally throughout the network to steal 10 gigabytes of data. Anything that's connected can be a weak link for hackers to gain entry to your network. Take a step back to look at how your IoT networks are connected to your traditional IT networks to determine how to segment them. This will help limit risks in an organization’s IoT ecosystem. 

5G is coming, and along with it is a stream of IoT devices and new technologies. But organizations must keep in mind that this means the attack surface is also going to expand significantly and increase opportunities for bad actors. Adopting a multi-layered approach, identifying the interconnectivity of devices and its physical environment, as well as deploying virtualization and automation among other defenses, will help to lessen risk and prepare organizations for the promises of IoT in a 5G world.

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Top story: "7 Steps to IoT Security in 2020."

Theresa Lanowitz is a proven global influencer and speaks around the world on trends and emerging technology poised to help today's IT organizations flourish. Prior to joining AT&T Cybersecurity, she founded industry analyst firm voke, to highlight emerging technologies and ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
HackerOne Drops Mobile Voting App Vendor Voatz
Dark Reading Staff 3/30/2020
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5347
PUBLISHED: 2020-04-04
Dell EMC Isilon OneFS versions 8.2.2 and earlier contain a denial of service vulnerability. SmartConnect had an error condition that may be triggered to loop, using CPU and potentially preventing other SmartConnect DNS responses.
CVE-2020-5348
PUBLISHED: 2020-04-04
Dell Latitude 7202 Rugged Tablet BIOS versions prior to A28 contain a UAF vulnerability in EFI_BOOT_SERVICES in system management mode. A local unauthenticated attacker may exploit this vulnerability by overwriting the EFI_BOOT_SERVICES structure to execute arbitrary code in system management mode.
CVE-2020-8142
PUBLISHED: 2020-04-03
A security restriction bypass vulnerability has been discovered in Revive Adserver version < 5.0.5 by HackerOne user hoangn144. Revive Adserver, like many other applications, requires the logged in user to type the current password in order to change the e-mail address or the password. It was how...
CVE-2020-8143
PUBLISHED: 2020-04-03
An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. A remote attacker could trick logged-in users to open a specifically crafted link and have them redirected to any destination.The CSRF protection of the “/...
CVE-2020-8147
PUBLISHED: 2020-04-03
Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.