itb-nz logo
Story image

Enterprise IoT ecosystem extends beyond corporate devices - Zscaler

28 May 2019

Cloud security company Zscaler has released its 2019 report,  IOT in the Enterprise: An Analysis of Traffic and Threats, which examines traffic stemming from IoT device footprints across the Zscaler cloud over the course of 30 days.

The Zscaler ThreatLabZ research team analysed 56 million IoT device transactions to understand the types of devices in use, the protocols used, the locations of the servers with which they communicated, and the frequency of inbound and outbound communications.

Over a 30-day period, 56 million transactions were processed in the Zscaler cloud from 270 different types of IoT devices made by 153 different manufacturers.

The analysis showed that more than 1,000 organisations have at least one IoT device transmitting data from the network to the internet via the Zscaler cloud platform.

The most commonly detected IoT device categories across the Zscaler cloud were IP cameras, smart watches, printers, smart TVs, set top boxes, IP phones, medical devices, and data collection terminals, among others.

“As is often the case with new innovations, the use of IoT technology has moved more quickly than the mechanisms available to safeguard these devices and their users,” says Zscaler chief technology officer and engineering and cloud operations executive vice president Amit Sinha.

“Within only one month of traffic, our threat research team saw an astronomical amount of traffic stemming from both corporate and personal IoT devices.”

“Enterprises need to take steps to safeguard these devices from malware attacks and other outside threats.”

Top IoT security concerns were:

  • Weak default credentials
  • Plain-text HTTP communication to a server for firmware or package updates
  • Plain-text HTTP authentication
  • Use of outdated libraries

“We observed that over 90% of IoT transactions are occurring over a plain text channel, which we believe makes these devices and the enterprises that house them vulnerable to crafted attacks,” says Zscaler security research vice president Deepen Desai.

“Enterprises need to assess their IoT footprint, as they will only continue to expand and raise the risk of cyber attacks. From changing default credentials to restricting access to IoT devices from external networks, there are a variety of steps that can be taken to increase the IoT security posture.”

The Zscaler ThreatLabZ research team consists of security experts, researchers, and network engineers responsible for analysing and eliminating threats across the Zscaler security cloud and investigating the global threat landscape.

The team shares its research and cloud data with the industry at large to help promote a safer internet.

Story image
AIOps and the evolution of IT infrastructure monitoring
As companies adapt to ongoing digital transformation, they will soon realise that they need more than just a dedicated IT team to view and manage the company’s IT infrastructure. That’s where AIOps comes in.More
Story image
IDC names top Digital Workplace Services vendors
A new MarketScape report from IDC names the Leaders and Major Players in the market that is seeing forced growth in the time of COVID-19.More
Story image
Gartner: Strong revenue growth forecast for container management software and services
This is the first time Gartner has published a forecast for container management, in response to the increasing importance of the underlying technology.More
Story image
Why DX is not complete without a transformed security architecture
Secure Access Services Edge (SASE) is the process by which core WAN edge capabilities like SD-WAN, routing, and WAN optimisation at branch locations are integrated with cloud-based security services like secure web gateways, firewall-as-a-service, cloud access security brokers, and more.More
Story image
Nutanix announces new remote IT solutions
Released in response to demand for remote-friendly IT infrastructure tools, the solutions are aimed at teams wishing to deploy and troubleshoot their cloud infrastructure within from anywhere.More
Story image
Keysight buys AI testing specialist Eggplant for $300m
The move sees Keysight strengthen its presence in the automation space, with the aim to further establish itself in the automated software test market across both the physical and protocol layers and into the application layers.More