The Internet of Things (IoT) is basically a network of devices that are all connected via networking. In almost all cases, this network is also connected to the Internet, making the devices on the network accessible anywhere in the world. Most IoT devices use wireless network connections to join the local network. The past few years have seen an incredibly wide range of devices add embedded network connectivity to become “smart.” Some of the many smart devices that are accessible via the Internet include:

• Lights

• Thermostats

• Refrigerators

• Laundry appliances

• Home entertainment systems

• Security systems

• Video cameras

• Sensors (temperature, smoke, fire, motion, vibration, light, etc.)

• Vehicles

• Wearable devices (watches, glasses, medical devices, exercise monitors, etc.)

The preceding list is woefully incomplete. The fact is, nearly all appliances, tools, vehicles, and many physical items either already have a network presence or can be optionally networked. This means consumers have access to a tremendous amount of information and can accomplish many tasks online. You can turn on your lights, turn up (or down) the thermostat, start your favorite music, disable the alarm system, and even start cooking your dinner, all before arriving home. Of course, this all comes at a price. Attackers are also aware of the many devices being added to the Internet each second. They can use these devices, many of which do not have sound security controls, to either penetrate personal or corporate networks or compromise the devices themselves. Each of these devices is a computer and can be used by attackers to launch attacks against other targets. September 2016 demonstrated real-world proof, with the Mirai malware discovering and exploiting IoT devices using a small table of 60 default usernames and passwords. The original Mirai and variants caused multiple distributed denial of service (DDoS) attacks over the next several months. On December 13, 2017, less than a year after the coders were identified, they pleaded guilty to crimes related to the Mirai botnet. With millions of IoT devices available, attackers only have to find the ones with the least amount of security and then just take over.

As IoT continues to grow in popularity, we will see more and more attacks on the device class. As a security professional, it is of utmost importance that you lead the charge in educating those around you to the benefits of using good basic security.