mirror of
https://github.com/LCTT/TranslateProject.git
synced 2024-12-29 21:41:00 +08:00
62 lines
5.1 KiB
Markdown
62 lines
5.1 KiB
Markdown
|
[#]: collector: (lujun9972)
|
|||
|
|
[#]: translator: ( )
|
|||
|
|
[#]: reviewer: ( )
|
|||
|
|
[#]: publisher: ( )
|
|||
|
|
[#]: url: ( )
|
|||
|
|
[#]: subject: (Report: Most IoT transactions are not secure)
|
|||
|
|
[#]: via: (https://www.networkworld.com/article/3530476/report-most-iot-transactions-are-not-secure.html)
|
|||
|
|
[#]: author: (Andy Patrizio https://www.networkworld.com/author/Andy-Patrizio/)
|
|||
|
|
|
|||
|
|
Report: Most IoT transactions are not secure
|
|||
|
|
======
|
|||
|
|
Data gathered by security provider Zscaler shows that not only are most internet-of-things transactions unsecured, they are also unauthorized as IoT creeps in as shadow-IT devices.
|
|||
|
|
Iot
|
|||
|
|
|
|||
|
|
The majority of [Internet of Things (IoT)][1] transactions don’t use even basic security, and there is a great deal of unauthorized IoT taking place inside the perimeter of enterprise firewalls thanks to shadow IT, a new study finds.
|
|||
|
|
|
|||
|
|
Security vendor Zscaler analyzed nearly 500 million IoT transactions from more than 2,000 organizations over a two-week period. [The survey][2] found 553 different IoT devices from more than 200 different manufacturers, many of which had their security turned off.
|
|||
|
|
|
|||
|
|
[[Get regularly scheduled insights by signing up for Network World newsletters.]][3]
|
|||
|
|
|
|||
|
|
The study was done on Zscaler’s own Internet Access security service. It found the rate of IoT growth to be explosive: When it first started monitoring IoT traffic in May 2019, IoT traffic generated by its enterprise customer base was 56 million IoT transactions per month. By February 2020, that number had soared to 33 million transactions _per day_, or one billion IoT transactions per month, a 1,500% increase.
|
|||
|
|
|
|||
|
|
Zscaler is a bit generous in what it defines as enterprise IoT devices, from devices such as data-collection terminals, digital signage media players, industrial control devices, medical devices, to decidedly non-business devices like digital home assistants, TV set-top boxes, IP cameras, smart home devices, smart TVs, smart watches and even automotive multimedia systems.
|
|||
|
|
|
|||
|
|
“What this tells us is that employees inside the office might be checking their nanny cam over the corporate network. Or using their Apple Watch to look at email. Or working from home, connected to the enterprise network, and periodically checking the home security system or accessing media devices,” the company said in its report.
|
|||
|
|
|
|||
|
|
Which is typical, to be honest, and let (s)he who is without sin cast the first stone in that regard. What’s troubling is that roughly 83% of IoT-based transactions are happening over plaintext channels, while only 17% are using [SSL][4]. The use of plaintext is risky, opening traffic to packet sniffing, eavesdropping, man-in-the-middle attacks and other exploits.
|
|||
|
|
|
|||
|
|
And there are a lot of exploits. Zscaler said it detects about 14,000 IoT-based malware exploits per month, a seven-fold increase over the previous year.
|
|||
|
|
|
|||
|
|
“Folks can keep their smart watches, smart closets, and whatever else they think is making them smart. Banning devices is not going to be the answer here. The answer is changing up the narrative on how we think about IoT devices from a security and risk standpoint, and what expectations we put on manufacturers to increase the security posture of these devices,” wrote Deepen Desai, Zscaler’s vice president of security research in a [blog post][5].
|
|||
|
|
|
|||
|
|
Desai said the solution is “taking a [zero-trust][6] mentality.” It may be a buzzword but, “it’s about security people not trusting any person or device to touch the network—that is, until you know who the user is, what the device is, and whether that user and device are allowed to access the applications they’re trying to reach.”
|
|||
|
|
|
|||
|
|
Naturally Zscaler sells such a solution, but he makes a valid point. This is an ages-old problem I have seen time and again; a hot new technology comes along, everyone rushes to embrace it, then they think about securing it later. IoT is no different.
|
|||
|
|
|
|||
|
|
Whatever your device, at least go into the settings and turn on SSL.
|
|||
|
|
|
|||
|
|
Join the Network World communities on [Facebook][7] and [LinkedIn][8] to comment on topics that are top of mind.
|
|||
|
|
|
|||
|
|
--------------------------------------------------------------------------------
|
|||
|
|
|
|||
|
|
via: https://www.networkworld.com/article/3530476/report-most-iot-transactions-are-not-secure.html
|
|||
|
|
|
|||
|
|
作者：[Andy Patrizio][a]
|
|||
|
|
选题：[lujun9972][b]
|
|||
|
|
译者：[译者ID](https://github.com/译者ID)
|
|||
|
|
校对：[校对者ID](https://github.com/校对者ID)
|
|||
|
|
|
|||
|
|
本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创编译，[Linux中国](https://linux.cn/) 荣誉推出
|
|||
|
|
|
|||
|
|
[a]: https://www.networkworld.com/author/Andy-Patrizio/
|
|||
|
|
[b]: https://github.com/lujun9972
|
|||
|
|
[1]: https://www.networkworld.com/article/3207535/what-is-iot-the-internet-of-things-explained.html
|
|||
|
|
[2]: https://info.zscaler.com/resources-industry-iot-in-the-enterprise
|
|||
|
|
[3]: https://www.networkworld.com/newsletters/signup.html
|
|||
|
|
[4]: https://www.networkworld.com/article/2303073/lan-wan-what-is-transport-layer-security-protocol.html
|
|||
|
|
[5]: https://www.zscaler.com/blogs/corporate/shining-light-shadow-iot-protect-your-organization
|
|||
|
|
[6]: https://www.networkworld.com/article/3487720/the-vpn-is-dying-long-live-zero-trust.html
|
|||
|
|
[7]: https://www.facebook.com/NetworkWorld/
|
|||
|
|
[8]: https://www.linkedin.com/company/network-world
|