Hallazgos clave del primer informe global de Keyfactor sobre el estado de la seguridad del IoT

As connected devices continue to blend the physical and digital worlds in exciting new ways, the potential cannot overshadow the risks and vulnerabilities. Product designers, equipment manufacturers, and businesses adopting  IoT technology must work together to understand and address the challenges of securing these devices at scale. 

That’s why Keyfactor and Vanson Bourne conducted an independent survey and analysis that examines the state of IoT security for both manufacturers and end users. The report, “Digital Trust in a Connected World: Navigating the State of IoT Security,” reveals concerns and challenges modern businesses face when establishing digital trust in today’s connected world.

The report includes insights from 1,200 professionals across North America, EMEA, and APAC, representing organizations in manufacturing, IT, telecom, energy, oil and gas, retail, construction, financial services, and many more. 

It also examines key factors contributing to the vulnerability of organizations using IoT and connected devices, including the rapid explosion of connected devices, the cost of inadequate cyber defense, and the complexity of where liability lies for successful cyber breaches. 

En este blog examinaremos algunas de las conclusiones más profundas.

La responsabilidad de la seguridad de los dispositivos puede ser mixta

El 48% de los encuestados cree que el fabricante de dispositivos IoT o conectados debería ser mayoritariamente o completamente responsable de las brechas cibernéticas en sus productos.

With so many IoT devices being deployed in highly personal settings (i.e., the home), breaches feel like more than a breach. For the consumer, it feels like a violation, which creates damning headlines and negative perceptions in the market. 

Cuando se trata de culpar a alguien, la percepción suele ser la realidad. Los clientes de los fabricantes de dispositivos llevarán su negocio a otra parte, incluso si podrían haber hecho más para evitar una vulnerabilidad. 

El 6% de los encuestados afirma que la culpa depende de la infracción.

La verdad quizá resida en el matiz de este 6%. 

It isn’t one party that owns the entire responsibility of security. Security can no longer be an afterthought in the design of the product. Many respondents said that manufacturers are obligated to release security patches and cover any known vulnerabilities or flaws. Even end users share some of the responsibility. They need education on secure practices when using and setting up IoT devices.

Las soluciones actuales no abordan la totalidad de los retos de IoT

El 93% de las organizaciones utiliza soluciones PKI para gestionar certificados y emitir identidades digitales, pero el 97% se enfrenta a retos a la hora de proteger su IoT y sus productos conectados.

Esto nos lleva a preguntarnos: ¿están utilizando las organizaciones los métodos o herramientas equivocados para proteger los dispositivos de IoT ? 

Organizations may not be sure. Over half of respondents agreed that their organizations lack the awareness and expertise to secure IoT devices against attacks, and many admitted that they don’t necessarily understand what being fully protected from cyber attacks would entail.

El apoyo de los proveedores será crucial a la hora de definir los objetivos de seguridad para los diseñadores y fabricantes de dispositivos de IoT , sobre todo porque las organizaciones informan de las distintas prioridades que buscan en los socios proveedores. La flexibilidad, el ahorro de costes y la visibilidad de los certificados ocupan los primeros puestos. Sin embargo, el ahorro de costes fue el principal objetivo para los fabricantes de equipos originales, mientras que la flexibilidad fue la más valorada por las organizaciones que utilizan dispositivos IoT . 

Los vendedores y las organizaciones deben tener muy claros los puntos débiles que necesitan resolver y cómo la solución puede satisfacer sus necesidades.

Hay mucho en juego en los ataques y cortes de suministro

El 98% de las organizaciones han experimentado interrupciones de certificados en los últimos 12 meses, y los fabricantes de equipos originales cuyas líneas de fabricación se vieron afectadas por interrupciones de certificados sufrieron una pérdida media en 12 meses de 2,25 millones de dólares.

The report found that as device numbers and usage scale, so does the friction involved with them, prompting organizations to seek solutions that address them. Nine out of 10 respondents said they would benefit from using a certificate lifecycle automation platform to manage certificates.

Smaller organizations (with employee counts between 500 and 4,999) are feeling the most urgency to solve the manual burden of certificate lifecycle management. Not only do these organizations suffer more from associated challenges like time savings and reducing their internal workload, but they are also less likely to possess the in-house skills to manage certificates properly. 

Infracciones de la ciberseguridad: repercusiones actuales y futuras

There are plenty of wild stories about IoT devices being hacked. Over the past few years, a number of incidents have made the news, from the infamous hackers that breached a casino through a connected fish tank thermometer, to Google’s Nest security cameras suffering a breach that gave intruders access to live video feed and microphone functions.

As IoT devices go more mainstream, finding their way into personal everyday settings, a breach means more than some exposed data. To consumers, a breach — whether to a connected device in their home or to a brand they know and trust —feels like a violation. As such, these incidents will become more public and generate more negative sentiment in the market. 

Take MGM Resorts’ cyberattack in September 2023 — it disrupted the casino’s operations and is expected to cause a $100 million hit to its third-quarter results. In addition to the financial fallout, the private data of customers who used MGM services before March 2019, including contact information, gender, date of birth and driver’s license numbers, was compromised and undoubtedly diminished guests’ trust.

Clorox released a sales report from Q3 of 2023 that showed an alarming hit to the company’s profits due to a cyber attack that took place in August. As of October, Clorox’s physical production systems still hadn’t fully recovered from the attack. The company expects a significant year-over-year sales decline due to the incident.

Examples like those are a reminder that  IoT devices have a foot in the real, physical world and stand to cause financial and reputational harm to companies and pose a host of other risks for consumers if they become compromised. According to the report, 89% of organizations that operate and use IoT products faced cyber attacks in the past 12 months, to the tune of $250,000 on average. Of these organizations, 69% reported an increase in cyber attacks on their IoT devices over the past three years.

Governments will soon begin taking steps to help consumers discern which products are secure. For example, in 2021, U.S. President Biden’s executive order on Improving the Nation’s Cybersecurity included plans for a consumer labeling program for IoT devices. That label — the U.S. Cyber Trust Mark — debuted in July 2023. Even though compliance with the label’s criteria is optional, it is being embraced by Amazon, Google, Best Buy, and other heavy hitters. Whether by regulation or the will of the market, a time is coming when the security of a connected device will matter in the eyes of a non-technical consumer. 

Lea el informe completo

La proliferación de dispositivos IoT está cambiando el funcionamiento de las organizaciones y la forma de interactuar de los consumidores en todo el mundo. Es emocionante ver cómo se desarrolla esta innovación. Al mismo tiempo, las organizaciones están sometidas a una presión cada vez mayor para proteger sus IoT y dispositivos conectados mientras navegan por un panorama digital cada vez más complejo que requiere una confianza total.

Las conclusiones del informe de Keyfactorreiteran la importancia de la seguridad basada en la identidad para quienes fabrican los dispositivos IoT y quienes los despliegan y operan en su entorno para establecer la confianza digital a escala.

No espere a que se produzca un fallo de seguridad para actuar: aprenda a reforzar la seguridad de IoT ahora mismo. Acceda al informe completo aquí.