The number of connected devices is exploding as the internet of things (IoT) plays an increasingly influential and transformational role in nearly every walk of life, at home, in the workplace, on the streets and production lines around the world. There will be 75 billion connected devices by 2025, Statista predicts, and this will help drive huge efficiencies for businesses as well as eliminating mistakes from manual processes.
As the number of devices continues to increase, so does the sheer weight of unstructured data within enterprises. Cybercriminals seek to manipulate such data for malicious purposes, intercepting IoT communications, from a sensor to a server, user to user or sensor to user, and altering its flow for their own personal gain. This could mean modifying the data to steal information, changing a value for financial gain or even industrial sabotage and state-funded cyberterrorism.
The wide influence and availability of IoT, and opportunities for malicious actors to intercept communications, poses a major risk to businesses. However, cybercriminals don’t always try to attack inside the businesses themselves because that’s hard to do. Though many prevention methods within organisations are not as effective as business leaders would like, 95 per cent of companies do nonetheless have a formal security policy in place that is shared with employees, according to an IDG study.
It is therefore far easier for hackers to concentrate on a business user that is working remotely, such as behind a personal firewall at home where the connection and devices are far less secure.
The rise of digital personal assistants, such as Google Home and Amazon Alexa, has exacerbated this threat and widened the attack surface. By targeting these kinds of sensors, hackers have new opportunities for stealing sensitive information. Last year, Security Research Labs claimed malicious apps could be designed to listen in on people’s conversations through Amazon’s Echo and Google’s Nest devices.
There is no other company in the world that’s better positioned to protect data through the internet than BlackBerry
“We’re seeing a very different kind of threat,” says Adam Enterkin, senior vice president of sales, Europe, Middle East and Africa, at BlackBerry. “It’s not just the data itself in its rawest form that’s under threat, but also voice information, certainly from a remote attack point of view. Anyone has been able to use a microphone for many years, but not had access to it unless it was right in front of them. That’s definitely something we see has changed.”
With flexible working only set to rise further, enterprises need to ensure they are secure. Yet while companies are surely investing in cyber-prevention, the frequency with which high-profile breaches are exposed in the media is not slowing. The recent attack on foreign exchange giant Travelex is just the latest in a long line of large companies whose customers expected more robust cyber-processes from them. Often, hackers aren’t concerned about whether it’s a mobile, server or desktop, they’re just trying to get in by whatever means they can.
“Some are now even chucking a USB key onto porches for kids to pick up and then put into the home computer or laptop. The hacker then has access to the families’ systems,” says Enterkin. “On top of that, an awful lot of people will have similar passwords for personal devices and their corporate systems. So, once a home laptop has been infiltrated, hackers can decipher passwords and get into corporate systems that way.”
A mentality shift is required among IT security professionals to ensure greater protection in the IoT age. Chief information security officers have spent years implementing policy-driven ways of protecting their assets, data and individuals, but enforcing the same rules and controls on everyone results in very inflexible ways of working.
Traditionally, companies will deploy their IT services, acquire policy-driven devices and security measures, and then see what’s happening in their environment. Based on information they see around threats and vulnerabilities, they then retrospectively try to fix the issues that exist.
This reactive approach cannot survive for long in the fast-changing world of IoT. Instead, BlackBerry is advocating beginning with a “left shift”, which requires a full review of security measures before deploying anything, rather than the other way around. It involves implementing a secure development life cycle and ensuring software is already at a certain security standard before it is deployed.
Crucially, it also means looking at more adaptive ways of applying security, driven by artificial intelligence (AI) and machine-learning algorithms which learn from all the data and behaviour that is monitored across an enterprise environment. In the IDG study, seven in ten IT professionals said it’s only a matter of time before the window of vulnerability has a negative effect on their business continuity.
By feeding AI-driven insights back into their systems, businesses can close the window of vulnerability and constantly evolve their approach to security. The transformative effect AI has on security was the key driver behind BlackBerry’s acquisition last year of cybersecurity firm Cylance.
“There’s a huge amount of data collated in the IoT. We can analyse that data and start to build mathematical algorithms which we then apply to an AI process,” says Enterkin. “Based on this information, we can start to predict what’s happening. We can look at every single thing that’s happened in malware and viruses over the last 30 years and predict how a virus or a piece of malware in the future will react and respond.
“By using AI and machine-learning models, we also end up in a position where not only are we more secure, but there is fundamentally a better user experience. Based upon set metrics and an analytical view, we can decide whether something is normal or requires action. BlackBerry is championing the user experience and enabling IT to be as frictionless as possible for employees, while providing robust security at the same time.
“There is no other company in the world that’s better positioned to protect data through the internet than BlackBerry because we’ve been doing it for the best part of 40 years. We can provide security at any level, including mobile devices, desktop and IoT. There are 150 million cars around the world today using BlackBerry software to communicate. We are even operating on the International Space Station. So BlackBerry is much more than just a mobile company. We provide security with a seamless touch.”
For more information please visit blackberry.com
