News
Report: IoT Security Spending To Hit $1.5 Billion by End of Year
- By Richard Seeley
- 04/05/2018
A recent Gartner report states that security spending this year for IoT devices will reach $1.5 billion, up from $1.2 billion in last year -- a 28 percent increase.
The firm also said in the report that it expects that number to reach $3.1 billion by 2021.
Gartner suggested that what is needed is "security by design."
Organizations may have gotten to the point where they need tools to tell them what they have and how devices work, because of the ad hoc way business units may have deployed IoT.
"In IoT initiatives, organizations often don't have control over the source and nature of the software and hardware being utilized by smart connected devices," Ruggero Contu, research director at Gartner, is quoted as saying. "We expect to see demand for tools and services aimed at improving discovery and asset management, software and hardware security assessment, and penetration testing. In addition, organizations will look to increase their understanding of the implications of externalizing network connectivity."
An HP Internet of Things research study from 2015 found that at that time "80 percent of devices along with their cloud and mobile application components failed to require passwords of sufficient complexity and length."
HP also reported that "70 percent of devices used unencrypted network service."
The HP report seemed prescient coming a year before the Denial of Service (DNS) attack in October 2016 that brought down parts of the Internet in North America.
But hackers don't necessarily need sophisticated methodologies to gain control of devices because in cases of inexpensive IoT products, getting the password is virtually child's play, explains J. Steven Perry in an IBM developerWorks article.
While noting that there are IoT device manufacturers who take security seriously, Perry notes that makers of inexpensive devices are more focused on making it easy to set up their product. Of course, it doesn't take a genius geek to get hold of the standard log-ins.
"Manufacturers continue to use easy userid/password combinations (for example, admin/admin, user/user, and so forth), or make up new, equally simple ones, which then quickly join the ranks of known vectors," Perry explains.
Those pushing industry standards such as embedded cryptography may eventually improve IoT security, he writes. But IoT is still in early days and reality doesn't always match up with ideals. So IoT adoption requires a buyer beware mentality.
"Unfortunately, many IoT devices do not support encryption, which means you need to really do your homework when investigating the devices you intend to use as part of your overall solution to make sure they provide encryption," Perry cautions.
Gartner predicts that IoT security holes will be addressed in the future especially for industries such as healthcare and automotive, which are already heavily regulated.
By 2021, Gartner predicts IoT security will increasingly be driven by the need to comply with industry and government regulation.
"Industries having to comply with regulations and guidelines aimed at improving critical infrastructure protection (CIP) are being compelled to increase their focus on security as a result of IoT permeating the industrial world," according to Gartner.
Growth of the Industrial Internet of Things (IIoT), where industries deploy a range of connected devices to automate business processes, is creating a need for greater security investment.
"Interest is growing in improving automation in operational processes through the deployment of intelligent connected devices, such as sensors, robots and remote connectivity, often through cloud-based services," Contu said. "This innovation, often described as Industrial Internet of Things (IIoT) or Industry 4.0, is already impacting security in industry sectors deploying operational technology (OT), such as energy, oil and gas, transportation, and manufacturing."