Securing Internet Connected Devices

Every Internet-connected business takes measures to protect their internal network from unauthorized access. However, certain devices are overlooked by network administrators, who are mainly concerned with protecting desktop and laptop computers, smartphones, and tablets. In many cases, other devices are accessible to the Internet in some way, perhaps unbeknownst to those in charge of security. Any device that is connected to a company’s internal network, and accesses the Internet in some way, can potentially be used by an intruder to gain access to an organization’s sensitive information.

Here’s an example: I have a printer in my home that is connected to my home Wi-Fi network. Printers with a built-in network connection are nothing new, and the benefits of such a feature are obvious. But it’s not as if my printer is directly connected to the Internet — like all devices in my home, it’s connected through a router, which is configured to allow incoming connections to specific ports on specific devices only. As long as the printer is not one of these allowed devices, there is zero chance of an intruder accessing it without first compromising another device on the network, right?

Actually, no. Even if you don’t forward any ports to your desktop computer, it can still be compromised if, for instance, someone visits an infected web page on a vulnerable browser. The same principle can apply to my printer. This is because in addition to receiving print jobs from computers on my local network, it can also use a service called “HP ePrint” to accept them from anywhere, through email or other online services. In order to do this, it needs to connect to the Internet and process information from an outside source. If the code responsible for processing this information contains a vulnerability, this printer is a potential entry point.

It’s not just printers either. These days, many devices have an Internet connection, where years ago, one wouldn’t see any purpose for such a feature. These include televisions, cars, coffee makers, and even thermostats, just to name a few. Every one of these can have security vulnerabilities which could potentially be used by an attacker to gain entry to your network.

The most effective way to protect yourself is to not connect any devices to the Internet unless there’s a specific reason why it needs to be connected. For those that do, the usual advice applies of keeping software up to date. If a security vulnerability is identified in a device, it is very likely that the manufacturer will post a firmware update to address it. This is all but guaranteed for major, well-known manufacturers. Unfortunately, if they don’t, it’s unlikely anyone else will, as most devices’ firmware isn’t open source. In these cases, the method for protecting it depends on the specific device, if it isn’t just to disconnect it from the Internet. This is something every IT security professional should be aware of. Taking steps to secure these devices may very well be what prevents your company from suffering a major breach.