* [Topics](/en/topics "Topics") * [Security](/en/topics/security "Security") * Security for IoT devices Security for IoT devices ======================== Published April 29, 2022•*4*-minute read Copy URL Jump to section --------------- OverviewWhere does security belong in IoT?Why is IoT security critical?Risks and challengesHow do you secure IoT devices? How can Red Hat help? Overview -------- [Internet of Things (IoT)](/en/topics/internet-of-things/what-is-iot) security is becoming increasingly important when it comes to the big picture of cybersecurity. While cybersecurity seeks to protect internet-connected systems from cyberthreats, IoT security is about protecting connected devices. IoT refers to any system of physical devices or hardware that receives and transfers data over networks without any human intervention. A typical IoT system works by continuously sending, receiving, and analyzing data in a feedback loop. If you’ve heard something referred to as "smart," that generally implies IoT. Typical consumer use cases range from smartphones, smartwatches, smart homes, and even self-driving cars. IoT devices are also widely used in healthcare, supply chain management, and industrial use cases like energy and manufacturing, known as [IIoT](/en/topics/internet-of-things/what-is-iiot). Where does security belong in IoT? ---------------------------------- IoT doesn’t have an “s” in it, but it should. Find out why in this video. This video can't play due to privacy settings To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers." Recommended for you Skill Builders: Discover how to operationalize security with DevSecOps and Red Hat Advanced Cluster Security for Kubernetes --------------------------------------------------------------------------------------------------------------------------- [Watch the webinar](https://www.redhat.com/en/events/virtual/skill-builders-discover-how-to-operationalize-security-with-devsecops-and-redhat-advanced-cluster-security-for-kubernetes?percmp=RHCTG0250000455235) Why is IoT security critical? ----------------------------- Organizations have a strong incentive to use more IoT devices, because of their data gathering and measurement abilities. With benefits like edge computing and real-time insights and analytics, these devices are often associated with digital adoption and transformation. However, growing your digital profile could also grow your risk. The biggest reason why IoT security is so important is because an IoT device can be used to gain unauthorized access into your systems. The average person might not realize that an IoT device can be hacked, but it can. And every IoT device added to your network increases the potential attack surface. Risks and challenges -------------------- Does someone really want to hack your printers, security cameras, or thermostat? Yes they do. Not because hacking an IoT device is their end game, but because your IoT device is step one in their larger plan to gain access to your network. They use your IoT device as a gateway to other systems that may be better protected from outside interference. Unfortunately, the same protections aren’t necessarily in place from the inside, so once an IoT device is compromised, there is an increased risk other systems will be compromised too. **Many IoT devices lack built-in security**. The biggest security risk when it comes to IoT devices is that they are often designed and built without security as a priority or even a forethought. When IoT device vulnerabilities are made public, low awareness means connected devices can linger unprotected for months and even years. For example: * To make set up easier, many devices ship with default passwords that aren’t required to change when placed on your network. * A manufacturer could unknowingly ship IoT devices with malware embedded in firmware because they didn’t properly scan source code used for development. **IoT devices are always on with remote access**. The 24/7 nature of IoT devices makes them equally desirable to those with good and bad intentions. It’s great that you can connect to an IoT device remotely, but that also means anyone can attempt to log in. Hackers use automation to search for and find devices that have publicly available IP addresses with passwords still set to default as a starting point for their attack. **The biggest challenges in managing IoT security are:** * **Lack of awareness**. Many people don’t realize that their IoT devices can even be hacked so they don’t take any steps to protect them. * **Managing sprawl**. The more IoT devices you have, the bigger the attack surface. And the sheer number of connected devices any one organization may have could overwhelm its ability to keep up with security management. Scaling your ability to manage IoT devices is critical to protecting your network, data, and systems. How and why might hackers exploit vulnerabilities in your IoT devices? Vulnerabilities are emergent and change over time, and the same can be said about a hacker’s motivation. Common cybersecurity vulnerabilities include ransomware, malware, phishing, and distributed denial of service (DDoS) attacks. Just a few examples of how these may be carried out through an IoT device are: * Taking advantage of devices with passwords still set to the default. * Finding IoT devices with known malware vulnerabilities that have not been patched. * Recruiting an army of connected devices to create a botnet to perform a DDoS attack. * Using an IoT device as a way into a network to spy and seek out sensitive information, possibly phishing from within your network. How do you secure IoT devices? ------------------------------ There are four main things to keep in mind when thinking about the security of IoT devices. 1. A single pane of glass: gain a level of visibility that shows all of the IoT devices on your network. 2. Control access: only allow authorized IoT devices you know to join the network and limit those devices’ access. 3. Monitor your network: have a good understanding of what "normal" activity looks like. This will allow you to monitor for strange behavior that merits further investigation. 4. Automate your response time: minimize the amount of time you are exposed by using an automated response. If, through monitoring, you discover that a connected device is vulnerable, an automatic follow up to contain and repair the issue will greatly reduce the risk of being compromised. 5 things you can do to improve the security of IoT devices: 1. Never assume an IoT device is incapable of being hacked. 2. Use a different password for each device/service and never stick with the default password. 3. Keep your connected devices up to date with the latest firmware and software. 4. Turn off WiFi or Bluetooth if or when the connectivity features are not needed. 5. Put IoT devices on their own network separate from your most important systems. You can go one step further and group devices to have more than one IoT device network based on a security profile. Everyone has a role to play in security. From end users to the security team, everyone should participate in maintaining security for your organization. How can Red Hat help? --------------------- Security is a continuous process. Our focus is providing the tools you need to control, monitor, and remediate across your network, infrastructure, and applications. Red Hat offers fully integrated security measures throughout your organization’s IT infrastructure, development stack, and life cycle. Organizations can enhance their security posture by combining individual features and functions across our products and services. [Talk to us about automating and simplifying your edge platform lifecycle operations](/en/about/contact/edge-offering "about | Contact | Edge Platform Architecture Review") The official Red Hat blog ------------------------- Get the latest information about our ecosystem of customers, partners, and communities. [Keep reading](/en/blog "The official Red Hat blog") Recommended for you Securing Kubernetes Clusters with Red Hat Advanced Cluster Security ------------------------------------------------------------------- Customers want to learn how Red Hat Advanced Cluster Security for Kubernetes (RHACS) can help them solve their security challenges. However, their security teams might lack experience with Kubernetes and OpenShift, and so they have challenges with implementation. [View course](https://www.redhat.com/en/services/training/do430-securing-kubernetes-clusters-red-hat-advanced-cluster-security?percmp=RHCTG0250000455236) Keep reading ------------ ### What is confidential computing? Confidential computing uses hardware-based computing to protect data when it’s not at rest or in transit—while you’re actually running it. [Read the article](/en/topics/security/what-is-confidential-computing "What is confidential computing?") ### What are SPIFFE and SPIRE? SPIFFE and SPIRE are a pair of open source projects for identity management in dynamic and varied computing environments. Together they solve many security problems. [Read the article](/en/topics/security/spiffe-and-spire "article | what are spiffe and spire?") ### Red Hat Enterprise Linux security Red Hat Enterprise Linux is a world’s leading open source Linux platform, enabling you to mitigate risk, enforce security configuration and policy, and streamline compliance strategy. [Read the article](/en/technologies/linux-platforms/enterprise-linux/security "product article | Red Hat Enterprise Linux security") Security resources ------------------ ### Related content * E-book [The state of cloud-native security](/en/resources/state-of-cloud-native-security-ebook) * Detail [CVE management on Red Hat Advanced Cluster Security](/en/resources/cve-management-advanced-cluster-security-detail) * Blog post [Attestation vs. integrity in a zero-trust world](/en/blog/attestation-vs-integrity-zero-trust-world) * Blog post [Red Hat to acquire Chatterbox Labs: Frequently Asked Questions](/en/blog/red-hat-acquire-chatterbox-labs-frequently-asked-questions) ### Related articles * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is access control?](/en/topics/security/what-is-access-control) * [What is a CVE?](/en/topics/security/what-is-cve) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [How Red Hat OpenShift enables container security](/en/technologies/cloud-computing/openshift/security) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is API security?](/en/topics/security/api-security) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) [More about this topic](/en/topics/security "More about this topic")