Blogs on IT Support and Cybersecurity for Small Business

With the shift in the manner in which humans interact with machines - and increased number of available machines, it is important to look at how these devices could have an effect on your data security. Today, we look at a few security issues that have popped up with the IoT and how responsible IT administrators can help their organizations ward off these negative situations.

The Things
The things you find in your workplace are honestly not that different than the things you will find in your home, your gym, or any other place you come into contact with smart equipment. There are the ones that the business utilizes, and the ones brought there by their employees. Wearables, like smartwatches, if directly attached to a network, can bring in nefarious code, but for the most part, these devices come with integrated security software (through their OS), and are less of a threat than devices that are left unprotected by their developer support.

The problem businesses have is that it’s against a consumer’s nature to disregard the cool, new devices because they may present a problem for them down the road. So now there are literally billions of smart devices connected to the Internet each day that don’t get any attention. This is largely because the idea of the “smart” life, the one where people are clamoring to be the first in their neighborhood to be using these smart technologies, simply hasn’t materialized, leaving support for older products at a minimum or non-existent. Turns out a small business doesn’t have the available capital to invest in replacing all their technology with smarter technology. So companies (and consumers) are doing it piecemeal. If IoT devices are to become the standard, manufacturers are going to have to find a way to provide IoT devices affordably. There is little doubt that a world where typical products are connected, monitored, and managed is still an inevitability, but that reality hasn’t developed as fast as some people projected.

IoT Uses for Business
The modern business typically tries to use innovative new tools in the most effective manner possible. The Internet of Things, however, may seem like one of those concepts that weren’t built for business use, as the tools that get the most press are smart appliances and energy-saving technology like smart thermostats and smart lights. This couldn’t be further from the truth. In fact, industry experts surmise that nearly 70 percent of all IoT implementations through 2020 will happen in a business setting.

So, what are some of these smart tools that an SMB should consider deploying?

1. Real-Time Data Management - By attaching all of your resources to a network, administrators are able to track every part of your business, whether that be expenses, workflow, hardware, etc.
2. Streamline Supply Chain - For the growing manufacturer, the IoT can become a complete game-changer. By having an IoT system capable of integrating with the complete production, distribution, and procurement processes, it can be free from human error, making business run much more efficiently. This is made possible through the use of data loggers, barcode readers and RFID tags.
3. Remote Worker Management - The IoT is helping connect systems that aren’t typically connected. As a result, the feasibility of having a staff of remote workers has never been more realistic. Companies will be able to reduce turnover, reduce costs, and get higher degrees of productivity out of their resources with the use of IoT-based integrations.
4. Workplace Management - For those businesses that are forced to (or who choose to) employ onsite workers, the IoT can be a major time and money saver. By deploying smart locks, smart thermostats, smart lighting, etc., you can save money and have complete control over how your workplace is setup and managed.
5. Time Management - You know those smart speakers everyone is getting as gifts? They can do a lot. In fact, they can do as much or more that a human assistant. Voice assistants like Alexa, Google Assistant, and Cortana (to name a few) will become important components of the modern workplace over the next few years; and, can function as a central hub of other IoT devices that you use for your business.

IoT and Data Security/Privacy
For the small or medium-sized business, the IoT is all about data; and, the questions that are presented when capturing it. Why, if it’s making things easier, is there this underlying fear about IoT? Whose data is it exactly? What data is helpful/hurtful to your organization?

To answer this, we have to know what exactly an IoT device is.

An Internet of Things device is any device that has integrated network functionality. That’s it. There doesn’t have to be much function to it, and as you’ll learn soon, security isn’t necessarily a priority either. Knowing that, you have to know that when each of these devices is accessed by people, it creates a veritable treasure trove of data. So, in order to properly use IoT devices for your business, you have to do two things:

1. Ensure data goes where it needs to go so it is protected or destroyed.
2. Secure the devices against threats.

That’s it. If you want to protect your network from the threats surrounding IoT devices, you’ll have to understand both the security of your network from the outside, and the integrated security of any device you allow to access your network.

The Threats
There are several threats the IoT can present, but two of them are extreme. The first one is the propensity for these devices to not be secure. Since new smart things are made every day, some of the older smart things will need to be upgraded to stay secure. The problem with this is that many devices don’t have strong support, and don’t necessarily even get updates. This can put your network in a very precarious position. When deciding which IoT devices to allow on your business’ network, you have to know that it comes with the security required.

The other threat is that, today, with so many devices providing access to a person’s sensitive information, lines are beginning to blur a bit as to what is good to use and what is too personal. For example, an employee wears a fitness band and connects it to your business’ network. Of course, all the data from that device is fully able to be captured, but should it be? The job of the IT administrator gets more difficult when they have to decide what data has to stay anonymous and what data is fair to use. This is why many cloud-based IoT platforms will present IT administrators with the ability to encrypt certain types of information. Since not all platforms do this, it is on the shoulders of the IT administrator to make sure they understand that (along with the security of the business’ network) users’ privacy needs to be made a priority.

As the IoT continues its immense growth, people will be utilizing it to improve their lives and their businesses. There is a lot that is misunderstood about the Internet of Things, and a lot that even experts don’t know yet. With its emergence, however, it will likely transform the way small and medium-sized businesses look at their data. For more information about the Internet of Things, visit our blog today.

To get the most out of A.I., we first need to understand why A.I. seems to be the likely answer to a lot of troubles surrounding network security.

What Makes A.I. So Helpful?
Automated systems might be able to help organizations protect a network to a certain degree, but there are a lot of reasons to be cautiously optimistic about their inclusion in modern network security. Considering the lack of technology education in today’s business environment, it can be difficult to acquire the skills needed to protect against high-level threats and implement necessary security solutions. This doesn’t change the fact that security is more important than ever before, though, as more devices are being introduced to networks every day. The more devices, the more likely threats are to surface, and the more difficult it is to protect networks. A.I., backed by algorithms to detect threats, has the potential to improve network security, as well as make the jobs of internal IT departments much easier.

Of course, there are several reasons why A.I. for network security isn’t the best solution. Here are a few of them.

Considering How Threats Are Detected by Artificial Intelligence
How does A.I. detect threats? Even if machine learning gives these solutions the ability to learn over time, it has to start somewhere. A.I. initially identifies threats based on algorithms assigned to them. According to the MIT Technology Review, A.I. is essentially “trained” to detect threats based on tags assigned to specific data sets. The unfortunate side-effect of this is that the programs can essentially be reverse-engineered by hackers if they get ahold of them, effectively giving malware developers the ability to create threats that aren’t identifiable by the majority of automated systems.

Overreliance on a Single Method
With only one way to detect threats, A.I. is quite vulnerable to being exploited, as hackers can simply turn that into their own advantage. This is why it’s so important to have multiple algorithms to detect threats, as only one isn’t going to be enough to keep all threats out of your network. Consider this hypothetical scenario: your office hires a single security guard that keeps watch over the front door of your building. There are no other guards on-site to protect the building, and you don’t have security cameras. While nobody is getting in the front door, what about the other entry points? It’s a simple fact that one algorithm is easily exploitable and far from an ideal security situation.

Coleman Technologies can help your business determine the best security solutions on the market, and they can be combined with our expertise and active monitoring to ensure data security from a variety of threats. To learn more, reach out to us at (604) 513-9428.

Shadow IT
In a lot of ways, productivity is a lot like the thing it produces, money. People will do anything to get more of it. Businesses, have a plan; and, while they also want to maximize productivity and money, they typically don’t put their whole enterprise in jeopardy to get a little bit more of it. Shadow IT is the process in which an employee will download and use a piece of software that hasn’t been tested or passed by a company’s IT administrator to try and get a little more done.

Often times, the employee is just showing initiative, with no real knowledge that by downloading and utilizing a certain off-brand software that they have just put their whole business in danger. This wouldn’t be such a major deal if it was an isolated incident, but studies show that nearly 80 percent of all employees admit to utilizing software that wasn’t selected, tested, and released for use by their IT administrator. These apps may have vulnerabilities that would-be infiltrators can take advantage of. That is why it is important to utilize the software that has been vetted by the company, even if that means losing out on a bit of productivity.

Cryptojacking
There are well over 1,500 different cryptocurrencies, and in 2018 crytojacking, the strategy of using malware to use a target computer’s resources to mine for cryptocurrency was a major problem for businesses. Since this is a computationally complex task, it significantly reduces the computer’s effectiveness and longevity. As a result, cryptojacking has become en vogue for hackers and others looking to mine cryptocurrency without the investment necessary to do it.

Most studies show that the effect of cryptojacking could get way worse in 2019 since the value of cryptocurrency has fallen significantly over the past year. This means more machines mining for crypto are necessary, and thus more attacks. Users are just learning how these attacks are carried out and how to protect their business against them.

Ransomware
While there was a reported reduction in the number of ransomware cases in 2018, it still remains a major concern for any business looking to build a comprehensive network security strategy. Ransomware, of course, is a strain of malware that encrypts parts of or entire computing systems and then demands payment in cryptocurrency in a set amount of time for safe return of the files/access.

Hackers using ransomware have taken to targeting healthcare organizations’ networks for the breadth of the sensitive data they hold on them. They’ve also began to target operational technology systems, since, as with healthcare, costs of restoration of these systems (rather than payment) are prohibitive. This produces a little more urgency to get the problem resolved.

Unsecured Internet of Things
The Internet of Things keeps expanding, but so does the security threats to networks as a result of security-light devices. With more and more devices presenting security problems for businesses and individuals alike, it becomes important to ascertain exactly what devices are present on your network at any given time. Remember, even if a security-less IoT device is connected to a network-attached smartphone, it still offers up a major vulnerability.

While this is a major threat, there has been a push to improve the security of IoT devices as of late. With more security-minded companies developing useful smart products, these concerns will begin to take a back seat. But until that shift has been well documented, you’ll want to be diligent in the manner in which you utilize IoT devices.

Phishing
No business goes very long without getting some type of phishing email. In fact, it is estimated that 156 million phishing emails are sent every day, making it the most used practice by hackers everywhere. The way it works is that since most accounts are secure enough not to be guessed outright, hackers search for ways for people to help them gain access to the accounts they want to get in to. Nearly every successful cyber attack begins with a successful phishing scheme.

A specific example called business email compromise (BEC) which targets specific members of an organization is responsible for over $12 billion in losses across the globe. Once thought to be an email scam that could be mitigated with strong spam filters, today’s phishing scam is taking on a new shape by utilizing text messaging, instant messaging, phone calls, and even the seemingly-benign social media quiz to gain access to business networks.

2019 is lining up to be another stellar year for business technology, and as more tech is used, more threats come with them. If you would like any more information about how to prioritize network security, give our IT experts a call at (604) 513-9428 today.

Of course, it’s not entirely the fault of the user, even if they do represent part of the blame for this. Internet of Things devices are well-known security threats, but it’s largely because of the way they are designed and developed. Even if the user was aware of the security issues presented by these devices, the truth is that there isn’t anything they can do about it barring just not using them outright.

This is due to the fact that the security issues found in Internet of Things devices are built into them, particularly because the developers of the devices don’t build them with security in mind. If you think about it in terms of what they are used to building--devices that don’t have any kind of connectivity--it all begins to make sense. A manufacturer who produces a smart blender isn’t a software engineer or a security professional. Up until that point, they just made blenders, so they had no need for software development or security. Unfortunately, this creates a device that is made with functionality in mind over security, much to the detriment of businesses.

These devices are most vulnerable to threats that could be patched, if only the Internet of Things devices were easily patched by the developer and the user. This isn’t currently the case. It’s practically impossible to distribute patches to all Internet of Things devices manually, so if the developer hasn’t enabled automatic updates, you can forget about the user actually doing it, unless it gets in the way of the core functionality of the device. While this responsibility would fall on the developer, some have also suggested the implementation of unique default passwords, as users often see no need to change the default password on their new device before putting it to work.

To counteract these threats, businesses have to implement measures to keep their networks safe from the wave of additional devices entering the office. Whether you’re aware of it or not, it’s likely that employees are bringing new devices to work every day, whether it’s a tablet or a smart watch. A Bring Your Own Device policy with clear-cut rules on what’s allowed and what’s not will go a long way toward keeping unwanted devices in the workplace, and it can help to provide a general outline for how these devices should be used in the office as well. Remember, it’s about the future of your business, not about inconveniencing anyone.

If your business could use a hand with implementing a BYOD policy, Coleman Technologies can help. To learn more, reach out to us at (604) 513-9428.