Users are eager to deploy data and services while neglecting security, making edge computing a new “front line” in cybersecurity. Patrol the edge, guard security, are you ready?
In 2017, a thermometer in a fish tank in a casino hotel lobby was hacked, allowing attackers to infiltrate the casino network and upload its “high roller” database to the cloud.
In May 2018, a denial of service attack initiated through IoT devices like routers, surveillance cameras, and digital recorders caused a company’s website to go offline for four days.
The IT department inevitably bears the responsibility of maintaining enterprise security, and these two cases illustrate why IT departments are increasingly troubled by edge security issues. As more computers are deployed at the enterprise edge in the form of IoT devices, robots, and other localized systems and networks used in remote facilities and user environments, the security protection work of IT departments has become increasingly difficult. In this entirely new edge computing environment, there are too many IT policies and security issues that need to be addressed and solved.
So, regarding edge security policies, what major vulnerability areas need attention, and how should enterprise IT departments respond?
1. Assets Everywhere
As long as you are responsible for asset management, all IT assets in the company are your responsibility, regardless of whether these assets come from the company’s IT or end users. Any oversight can provide hackers with an entry point.
However, as more non-IT personnel participate in the deployment and management of edge networks, the risk of vulnerabilities increases. The practice of non-IT personnel deploying and managing networks at the enterprise edge creates the “island effect” — central security agencies like IT departments no longer have visibility over all devices and networks.
In one case, the IT department of a hotel company was even unaware that the company had installed 400 smart microwaves. If the IoT network formed by these microwaves suffers a denial of service attack, how significant would the losses be from poorly cooked steaks and disappointed customers?
One reason for the expansion of edge computing is that its deployment has shifted from the IT department to the end business departments. The new generation of employees only seeks to complete their tasks at the company edge, so they are more accustomed to ignoring IT and neglecting the responsibility to protect the security of their deployed systems and IoT devices.
Consequently, in IT procurement decisions, globally 90% of CIOs may sometimes be bypassed by business users, with 31% often being ignored. Knowing what technologies your company actually has has become a very realistic issue.
One solution to this problem is to adopt an asset management system to track all technological assets, whether centrally deployed or located at the edge. However, such systems often require manual entry of assets, and if you do not know what assets have been purchased, you naturally cannot track them.
Another solution is to use device detection software to automatically detect new devices, allowing for better tracking of asset changes and the application of appropriate risk management tools and strategies.
Using device detection technology can also clarify the main sources of traffic. Uber has achieved great success using device detection technology. First, IT identifies level 1 security risks and ensures that all systems and devices are protected. Then, relatively less important level 2 security risks can be signed off by anyone. As long as security levels are clearly defined, corresponding monitoring and risk management measures can be applied. The bottom line is that IT needs to know what is deployed at the edge, needs to clearly delineate security risk levels, and define applicable tools and operations. Most importantly, IT needs to work closely with users, acting as security drivers rather than enforcers.
2. Human Factors
Under the pressure of urgent production schedules, workshop managers easily focus only on production progress, and whether the computer numerical control lathes are hacked is not on their radar. In production environments, passwords are shared, proprietary information is disclosed, and rooms that should be locked for robots and IoT systems are left open.
One response is to strengthen the security of hardware and IoT devices by encrypting the data they store/process.
Another method is to adopt a zero-trust network.
The concept of zero trust was first proposed by Forrester Research in 2010, with the core idea being that no user/device, whether internal or external to the enterprise, is trusted, and must meet all security standards to gain network access.
A zero-trust network detects and intercepts abnormal data flows on the enterprise network. Because only a limited group of users is authorized, this detection is simplified. The zero-trust network is also an excellent edge technology that compensates for the need for remote management of enterprise edge computing rather than IT hosting.
3. Shadow IT
According to Gartner research, shadow IT now accounts for 30-40% of enterprise technology spending. Researchers from the strategic consulting firm Everis found that shadow IT constitutes half of enterprise computing. Most shadow IT is deployed at the enterprise edge, and when the IT department discovers these shadow technologies, it naturally wants to implement security policies on them.
IT departments need to change their approach to treating this headache as a band-aid solution. Such situations should not be viewed as potential security issues but rather as opportunities to solve problems.
IT departments should audit and recommend security tools and services that end users can use to protect their systems.
Additionally, IT can embed edge computing security and identity management technologies into every system, regardless of whether these systems are located at the enterprise edge.
Here’s how to do it:
Require that all new technologies must be integrated into an already secured zero-trust network. Since this network is established, IT departments do not need to face end users directly; end users can advance their technologies themselves. Furthermore, IT departments can publish policies and toolsets that drive end-user security. For example, technology vendors will not actively enhance the security of application layers, operating system layers, user layers, and physical layer devices, but if end users know to request these security features during the request for proposal (RFP) phase, then technology vendors will have to seriously strengthen their security foundations. This is the role of early IT guidance.
4. Unpatched Operating Systems
The practice of end users deploying various devices and systems poses significant risk management issues, primarily reflected in the IT department’s lack of understanding of these obscure operating systems.
Hotels installing smart microwaves in their kitchens and medical institutions heavily using patient monitors, insulin pumps, and various IoT devices are particularly vulnerable to attacks — because these devices are often installed and used by end users, and their operating systems are generally uncommon.
In this situation, the IT department needs to do two things:
1) Use a network that can automatically detect new asset additions, or work closely with end users to promptly discover or identify newly online assets;
2) Collaborate with suppliers of these devices or systems to establish procedures for executing regular software updates on these uncommon operating systems.
For devices running common operating systems, IT departments use automated push update software to ensure timely fixes for software vulnerabilities and real-time management of software patches.
Another option is to adopt a “pull” update strategy, allowing end users the freedom to decide when to install patches or operating system versions. However, this practice is not the best operation, as whether updates are “pulled” or not depends on whether end users remember to install them.
5. Risk Management and Disaster Recovery
The security measures of enterprise IT certainly do not stop at establishing a zero-trust network and providing end users with security management tools and policies. Integrating edge computing into enterprise risk management and disaster recovery plans is also the responsibility of enterprise IT.
Survey data shows that only 27% of companies have formal and ongoing business continuity plans. This reflects the reality that most companies struggle to do a good job with disaster recovery.
Companies are somewhat lagging behind the times in updating their edge computing disaster recovery plans. Mission-critical systems, networks, and devices deployed at the edge should be identified in advance, and preparations should be made for responses in case of an intrusion. If an intrusion event occurs, attackers may have already infiltrated the devices and been exploring for a long time. Such situations should be handled within a risk management framework, clarifying the impact of security incidents on the company and brand. The impact could be accusations of negligence from customers and partners or a loss of tens of millions of dollars in company valuation. No one wants to see these situations occur, so effective edge computing security policies must be established.
6. Vendor Review
Isolated networks protected by firewalls can be established, providing two-way authentication and transaction payload encryption to manage access points for edge devices. Additionally, information from various groups of transactions can be collected through sensors to determine whether the sensor data patterns are valuable.
Edge technology vendors should be able to provide the above functions. Of course, companies should further discuss security issues with vendors to see what security features their hardware and software possess. Then, make good use of these security functions. If vendors cannot provide adequate security guarantees, it is better to switch to another one.
Conclusion
Users are always eager to deploy data and services while relegating security to a secondary position. IT departments can enhance the success rate of the company’s overall security strategy by introducing identity management, data encryption, zero-trust networks, and patch management checkpoints into edge computing security protection and detection projects.
Related Articles
Hackers Use Fish Tank to Breach Casino
Infrared Cameras Render Physical Isolation Meaningless
