sb-as logo
Story image

Enterprise IoT ecosystem extends beyond corporate devices - Zscaler

28 May 2019

Cloud security company Zscaler has released its 2019 report,  IOT in the Enterprise: An Analysis of Traffic and Threats, which examines traffic stemming from IoT device footprints across the Zscaler cloud over the course of 30 days.

The Zscaler ThreatLabZ research team analysed 56 million IoT device transactions to understand the types of devices in use, the protocols used, the locations of the servers with which they communicated, and the frequency of inbound and outbound communications.

Over a 30-day period, 56 million transactions were processed in the Zscaler cloud from 270 different types of IoT devices made by 153 different manufacturers.

The analysis showed that more than 1,000 organisations have at least one IoT device transmitting data from the network to the internet via the Zscaler cloud platform.

The most commonly detected IoT device categories across the Zscaler cloud were IP cameras, smart watches, printers, smart TVs, set top boxes, IP phones, medical devices, and data collection terminals, among others.

“As is often the case with new innovations, the use of IoT technology has moved more quickly than the mechanisms available to safeguard these devices and their users,” says Zscaler chief technology officer and engineering and cloud operations executive vice president Amit Sinha.

“Within only one month of traffic, our threat research team saw an astronomical amount of traffic stemming from both corporate and personal IoT devices.”

“Enterprises need to take steps to safeguard these devices from malware attacks and other outside threats.”

Top IoT security concerns were:

  • Weak default credentials
  • Plain-text HTTP communication to a server for firmware or package updates
  • Plain-text HTTP authentication
  • Use of outdated libraries

“We observed that over 90% of IoT transactions are occurring over a plain text channel, which we believe makes these devices and the enterprises that house them vulnerable to crafted attacks,” says Zscaler security research vice president Deepen Desai.

“Enterprises need to assess their IoT footprint, as they will only continue to expand and raise the risk of cyber attacks. From changing default credentials to restricting access to IoT devices from external networks, there are a variety of steps that can be taken to increase the IoT security posture.”

The Zscaler ThreatLabZ research team consists of security experts, researchers, and network engineers responsible for analysing and eliminating threats across the Zscaler security cloud and investigating the global threat landscape.

The team shares its research and cloud data with the industry at large to help promote a safer internet.

Story image
Google and Amazon overtake Apple as most imitated brands - Check Point
Google and Amazon were the most imitated brands in phishing attempts for the second quarter of 2020, according to Check Point. More
Download image
A guide to the email galaxy - and how to avoid catastrophic cyber threats
Some 60% of organisations believe it’s inevitable or likely they will suffer from an email-borne attack in the coming year.More
Story image
Improving network security by ‘deflecting’ cybercriminals
Even with the best perimeter defences in place, malicious actors can still gain access to a network and resources connected to it. But a new technique has made it significantly easier to spot these cyber-attackers.More
Story image
Almost 70% of APAC consumers willing to trade privacy for better UX
Respondents from China (82%), India (79%) and Indonesia (79%) are the most willing to share their data, with respondents from Japan (43%), Australia (50%) and Singapore (58%) being the least likely to trade data for more seamless experiences.More
Download image
451 Research: The new shape of the enterprise network
In this new world, distance has become the silent digital business killer. Latency looms large, especially for high-performance edge applications, IoT and 5G use cases. More
Story image
How business can lift protection against mobile threats
The mobile phone has become ubiquitous both personally and professionally. Many of these devices are able to access corporate networks and sensitive data, yet many may not be as protected or secured as company-owned devices.More