IoT Security Risks: Lessons from French Fridges
The plight of supermarket staff in France having to remove tons of spoiled food and work late to restock fridges wouldn’t typically rate as a major topic of discussion for business leaders here in Australia. But the recent sabotage of France’s internet-driven refrigeration control systems in around 700 supermarkets across the country has definitely triggered alarm bells. It serves as a wake-up call for businesses in Australia and around the world because it provides a clear perspective of the IoT attack surface.
In this case, attackers took remote control of older refrigeration control systems, sending digital thermostats controlling hundreds of supermarket fridges into overdrive. In some cases, temperatures rose from as low as -27C to well over 50C, turning the chillers to erstwhile ovens in Carrefour, Intermarché, Coopérative U, and more.
The hackers didn’t even need to be overly sophisticated. They simply needed to access the system over the internet to be able to expose basic flaws and set the defrost function to full throttle. But old equipment wasn’t the problem, rather its visibility over the internet was.
And here’s the really sobering thought: Most operational equipment is built to last for ten years or more but the software inside it is not, making every connected device an attack surface that hackers can exploit. This includes everything from smart lighting, heating, and ventilation systems to refrigeration control systems, motion detection sensors, security cameras, and much more. Because the extended Internet of Things (xIoT) is continuously and silently managing so many parts of modern infrastructure, it becomes a business risk when that equipment can be found and reached on the internet.
Why IoT security risks matters to business leaders
Unmanaged smart devices represent one of the fastest growing security risks in enterprise environments. These devices can often reside beyond traditional IT boundaries, leaving organisations exposed to an unchanged default credential or a system that’s not counted on the asset list. Given the cybersecurity risks inherent in operating xIoT devices, it’s essential for companies to activate and update enterprise IoT protection strategies.
How to avoid unauthorised IoT access
To avoid hackers getting unauthorised control of critical systems, it’s critical for companies to take proactive measures. In much the same way that MDM solutions are used to deliver control, protection and compliance for mobile devices and data on your network, you need to apply similar measures to managing xIoT.
What to ask your IT team
- Do you have an automated inventory tracking all IoT devices on your network?
-
Do you isolate IoT devices on a separate network away from core corporate business traffic?
-
How do you handle security updates, firmware patches, and end-of-life hardware?
What is imei IoT Protect?
To safeguard your xIoT environment, imei offers the industry's only xIoT discovery and remediation platform as part of imei IoT Protect.
Built on Phosphorus, a Dragos company, Intelligent Active Discovery, imei’s IoT Protect managed service provides accurate, safe, and rapid discovery of all xIoT devices on your network. The solution effectively eliminates the xIoT security gap, finding every xIoT device on your network, fixing it, and bringing everything into compliance.
As a managed service, our expert team delivers imei IoT Protect in three distinct stages, minimising the time and internal resources you need to manage this area of cybersecurity risk.
imei IoT Protect–Discover
A scan of your network identifies all xIoT devices, capturing unmatched deep device metadata. We classify devices and allocate them against a proprietary database of more than 1.3 million xIoT device records.
imei IoT Protect–Remediate
Timely remediation of identified risks reduces ongoing risk and prevents threats.
imei IoT Protect–Manage
Ongoing monitoring and management of device security and vulnerabilities continuously protects against xIoT threats.
Get ahead of growing xIoT cybersecurity risks
For more information on imei IoT Protect and getting a clear read on your IoT environment and especially IoT attack surfaces that don’t look like typical network endpoints, please get in touch.
