Combining ZTNA and the right network hardware to secure your IoT environment

The temptation to massively scale new technology so often overpowers the responsibility to ensure that the technology remains secure. The world of the Internet of Things — or IoT — is a prime example. IoT is growing exponentially and positively impacting industries such as health care, office buildings, manufacturing and retail.

In Australia, the government released the voluntary Code of Practice: Securing the Internet of Things for Consumers (Code of Practice) in 2020. While the Code of Practice is a first step towards lifting the security of smart devices in Australia, it covers consumer devices only. It doesn’t provide requirements or even guide enterprises on how best to secure their IoT devices or the data that those devices process. In the absence of federal guidance, IT managers and cybersecurity professionals are often left questioning how best to fill the deficit between their IoT environment scale and effectively securing that environment.

Despite a lack of formal regulation on business IoT security, it’s important for enterprises today to do all they can to secure their IoT devices, thereby protecting their networks. This means IT leaders and cybersecurity professionals must understand the unique challenges IoT devices present, why a zero-trust approach is so important, and how the right network hardware can help secure an enterprise IoT environment.

IoT’s unique security challenges

There are a few factors about connecting to IoT devices and infrastructure that present challenges for enterprises who want to secure their IoT environment. First, the amount of IoT devices in circulation has grown exponentially. There are now an estimated 41.76 billion IoT devices that exist globally in 2023 and research firm IDC predicts that spending on Internet of Things in Australia and New Zealand will reach $24 billion by 2026. This will contribute — and quite frankly is already contributing — to IoT device sprawl for many businesses. As many IT leaders and cybersecurity personnel are aware, any growth in IoT corresponds to a growth in potential attack surface. Also, there are IT personnel and business leaders who are apprehensive about the costs associated with securing an IoT environment due to the challenges and scale. In turn, they are not sufficiently investing in the technology needed to keep their IT architecture secure.

In addition to cost concerns and the sprawl associated with IoT devices, many current security methods aren’t equipped for how IoT devices communicate with each other or for how ‘bad actors’ can penetrate IoT devices. First, most security methods are designed with an agent or end user in mind. This includes the use of passwords or even two-factor authentication. However, IoT devices can’t respond like end users. Also, IoT devices have limited processing power, which makes it more difficult for them to perform effectively if they need to house large-scale security software.

Many enterprises recognise the need to keep their IoT environment secure, but current, popular methods aren’t cutting it. One common option is through a virtual private network, or VPN. However, establishing VPNs at scale is complex to set up and maintain. VPNs have another fatal flaw — once a bad actor is inside the network, they can have unlimited access. There are also networks that use private access point nodes (APNs), provided by a cellular provider. However, private APNs don’t allow enterprises to take full control of their network and manage how they secure their IoT deployments.

So, what’s the best way to secure your IoT architecture?

The answer is with an efficient, zero trust network access (ZTNA) approach. Zero trust is the only way for enterprises to ensure that IT teams can easily establish a completely secure network connection. Also, it eliminates the possibility of dangerous lateral traffic between IoT devices and potentially other critical databases and assets.

The problem for many enterprises is that zero trust may for them be the latest security buzzword, rather than an established concept with a defined path to implementation. Also, there may be scenarios where IT departments lack the people or expertise to set up a network with comprehensive and efficient security measures. This is why it’s important for IT leaders to select a network solution that makes IoT security efficient, easy to configure, easy to manage, and comes with the right hardware to complete a comprehensive security approach.

Through proper research, IT leaders will find there are routers built specifically for IoT connectivity that can allow businesses to leverage the benefits of their IoT environment while keeping their processing power and security needs top of mind. For example, Cradlepoint’s S700 router can offload security processes to a service gateway so that IoT devices can still adhere to zero trust security policies without those policies burdening the performance of the router.

IT leaders will also find the right router will be multipurpose. IoT environments connect various parts of a business or organisation; therefore, the right router should power that connection. Also, enterprises should find a router that can efficiently connect over various transport types such as cellular, Wi-Fi and wired. This helps promote network resiliency.

The right network solution will easily allow enterprises to implement the zero trust network policies that will make their IoT environments inherently secure. For example, Cradlepoint’s NetCloud Exchange solution allows IT leaders to easily configure their wide-area networks (WAN), automatically implementing zero trust principles, and also extend this protection to the connected IoT devices. IoT devices are then immediately following zero trust policies, such as being dark to public scans and only accessible through the proper authorisation. The latter is especially important for enterprises, since many WANs are connected to third parties and proper third-party access is a must-have for business.

A new approach to IoT and security

It’s past the time for the security of IoT environments to catch up to the proliferation of IoT environments. With Australian businesses’ greater dependence on IoT devices, the expansion of connectivity technology like 5G and the anticipated massive growth of the IoT market, cybersecurity personnel are in danger of perpetually playing catchup to how big their company’s IoT architectures can grow. This is why it’s important for businesses to lean less on traditional security measures like VPNs and private APNs and invest in the latest in IoT connectivity hardware and zero trust technology.

Image credi: iStock.com/alexsl