There’s a lot being said in various quarters about the Internet of Things (IOT) but whenever it comes up in conversation with senior people in the SME world, even those businesses that are in the medium bracket, with significant numbers of employees, it raises a titter or two.

So, what is it and why would that be?  According to Wikipedia IOT describes devices with sensors, processing ability, software and other technologies that connect and exchange data with other devices and systems over the Internet or other communication networks. The IOT encompasses electronics, communication, and computer science engineering and encompasses a vast array of devices — from household appliances to industrial equipment — all connected online. These devices often lack robust security features, making them susceptible to attacks. Common vulnerabilities include insecure firmware, weak authentication protocols and unsecured network services. For example, IOT devices can be compromised to create botnets that launch massive Distributed Denial of Service (DDoS) attacks. As the IOT continues to grow, securing these devices becomes increasingly critical, necessitating the development of new security strategies that encompass IOT.

IOT in a nutshell then, does not just refer to everyday household items that have a processor and remote capability, but also systems within your business.  For instance, if you can turn on your lights, start a cooker going, turn on the kettle etc, all from your phone on your way home, you can do the same on your way into work.  And of course, we have Siri, and Alexa amongst other systems, all interconnected in some way in your home, and increasingly, in your office, and to the internet. 

Whenever it’s discussed all the usual lighthearted comments about being hacked by your kettle, or held to ransom by your toaster, come out in the conversation.  And there is some amusement to be had.   But there is a serious side to this.  

Increasingly now we are seeing smart appliances in the workplace, that could be used to jump onto the more serious elements of a network, we are already at a place where some functions, perceived as routine, even mundane, can already be used to jump onto other network devices.  For instance, most have security cameras and alarm systems.  Many of these are IP based and are connected via the LAN.  OK, but many also are remotely maintained by a variety of suppliers.  I have found it not uncommon for these suppliers to arrange for their own backdoor into the system to maintain these systems, often without the client knowing how that is done.  This provides a very neat circuit around the router and firewall and, when most SME networks are flat, access onward to all parts of the network.  A flat network refers to a network that is unsegmented ie all devices are attached to a single WIFI or wired network with no further network protection once through the gateway.

This of course is not the only example, but it shows how poor security architecture, often times by local network providers, can have a quite seriously detrimental effect.  So, what I am saying is that as many more devices become ‘smart’ and interconnected via the LAN, security architecture becomes just as important for the SME as it does for the larger enterprise.  The problem is that the awareness and support within the SME community and their suppliers, tends to be lacking.

These days we have to add in the move towards remote working, either full or part time, and the increasing use of AI, which adds many other threats to your systems, and I have explored these in other blogs, which you can view on my website, https://hah2.co.uk/news/.  How many of your staff, using their home WIFI to connect to your company systems, also have IOT devices connected to the same WIFI router that they are using to connect to you?  How are you managing that risk?  Or are you?