Principales conclusions du premier rapport mondial sur l'état de la sécurité du site IoT ( Keyfactor)

As connected devices continue to blend the physical and digital worlds in exciting new ways, the potential cannot overshadow the risks and vulnerabilities. Product designers, equipment manufacturers, and businesses adopting  IoT technology must work together to understand and address the challenges of securing these devices at scale. 

That’s why Keyfactor and Vanson Bourne conducted an independent survey and analysis that examines the state of IoT security for both manufacturers and end users. The report, “Digital Trust in a Connected World: Navigating the State of IoT Security,” reveals concerns and challenges modern businesses face when establishing digital trust in today’s connected world.

The report includes insights from 1,200 professionals across North America, EMEA, and APAC, representing organizations in manufacturing, IT, telecom, energy, oil and gas, retail, construction, financial services, and many more. 

It also examines key factors contributing to the vulnerability of organizations using IoT and connected devices, including the rapid explosion of connected devices, the cost of inadequate cyber defense, and the complexity of where liability lies for successful cyber breaches. 

Dans ce blog, nous examinerons quelques-unes des conclusions les plus importantes.

La responsabilité de la sécurité des appareils peut être partagée

48 % des personnes interrogées estiment que le fabricant de IoT ou d'appareils connectés devrait être en grande partie ou totalement responsable des violations cybernétiques de ses produits.

With so many IoT devices being deployed in highly personal settings (i.e., the home), breaches feel like more than a breach. For the consumer, it feels like a violation, which creates damning headlines and negative perceptions in the market. 

Lorsqu'il s'agit de blâmer quelqu'un, la perception est souvent la réalité. Les clients des fabricants d'appareils iront voir ailleurs, même s'ils auraient pu faire plus pour prévenir une vulnérabilité. 

6 % des personnes interrogées ont déclaré que la responsabilité dépendait de la violation.

La vérité réside peut-être dans la nuance de ces 6 %. 

It isn’t one party that owns the entire responsibility of security. Security can no longer be an afterthought in the design of the product. Many respondents said that manufacturers are obligated to release security patches and cover any known vulnerabilities or flaws. Even end users share some of the responsibility. They need education on secure practices when using and setting up IoT devices.

Les solutions actuelles ne répondent pas à l'ensemble des défis posés par le site IoT

93 % des organisations utilisent des solutions PKI pour gérer les certificats et délivrer des identités numériques, mais 97 % d'entre elles sont confrontées à des difficultés pour sécuriser leur site IoT et leurs produits connectés.

D'où la question suivante : les organisations utilisent-elles les mauvaises méthodes ou les mauvais outils pour sécuriser les appareils IoT ? 

Organizations may not be sure. Over half of respondents agreed that their organizations lack the awareness and expertise to secure IoT devices against attacks, and many admitted that they don’t necessarily understand what being fully protected from cyber attacks would entail.

Le soutien des fournisseurs sera crucial pour définir les objectifs de sécurité des concepteurs et fabricants d'appareils IoT , d'autant plus que les organisations font état de différentes priorités qu'elles recherchent auprès des fournisseurs partenaires. La flexibilité, la réduction des coûts et la visibilité des certificats sont les priorités. Cependant, les économies de coûts étaient l'objectif principal des OEM, tandis que la flexibilité était la plus importante pour les organisations utilisant des appareils IoT . 

Les fournisseurs et les organisations doivent être très clairs sur les problèmes qu'ils doivent résoudre et sur la manière dont la solution peut répondre à leurs besoins.

Attaques et pannes : des enjeux importants

98 % des organisations ont connu des pannes de certificat au cours des 12 derniers mois, et les équipementiers dont les chaînes de fabrication ont été affectées par des pannes de certificat ont subi une perte moyenne de 2,25 millions de dollars sur 12 mois.

The report found that as device numbers and usage scale, so does the friction involved with them, prompting organizations to seek solutions that address them. Nine out of 10 respondents said they would benefit from using a certificate lifecycle automation platform to manage certificates.

Smaller organizations (with employee counts between 500 and 4,999) are feeling the most urgency to solve the manual burden of certificate lifecycle management. Not only do these organizations suffer more from associated challenges like time savings and reducing their internal workload, but they are also less likely to possess the in-house skills to manage certificates properly. 

Violations de la cybersécurité : impacts actuels et futurs

There are plenty of wild stories about IoT devices being hacked. Over the past few years, a number of incidents have made the news, from the infamous hackers that breached a casino through a connected fish tank thermometer, to Google’s Nest security cameras suffering a breach that gave intruders access to live video feed and microphone functions.

As IoT devices go more mainstream, finding their way into personal everyday settings, a breach means more than some exposed data. To consumers, a breach — whether to a connected device in their home or to a brand they know and trust —feels like a violation. As such, these incidents will become more public and generate more negative sentiment in the market. 

Take MGM Resorts’ cyberattack in September 2023 — it disrupted the casino’s operations and is expected to cause a $100 million hit to its third-quarter results. In addition to the financial fallout, the private data of customers who used MGM services before March 2019, including contact information, gender, date of birth and driver’s license numbers, was compromised and undoubtedly diminished guests’ trust.

Clorox released a sales report from Q3 of 2023 that showed an alarming hit to the company’s profits due to a cyber attack that took place in August. As of October, Clorox’s physical production systems still hadn’t fully recovered from the attack. The company expects a significant year-over-year sales decline due to the incident.

Examples like those are a reminder that  IoT devices have a foot in the real, physical world and stand to cause financial and reputational harm to companies and pose a host of other risks for consumers if they become compromised. According to the report, 89% of organizations that operate and use IoT products faced cyber attacks in the past 12 months, to the tune of $250,000 on average. Of these organizations, 69% reported an increase in cyber attacks on their IoT devices over the past three years.

Governments will soon begin taking steps to help consumers discern which products are secure. For example, in 2021, U.S. President Biden’s executive order on Improving the Nation’s Cybersecurity included plans for a consumer labeling program for IoT devices. That label — the U.S. Cyber Trust Mark — debuted in July 2023. Even though compliance with the label’s criteria is optional, it is being embraced by Amazon, Google, Best Buy, and other heavy hitters. Whether by regulation or the will of the market, a time is coming when the security of a connected device will matter in the eyes of a non-technical consumer. 

Lire le rapport complet

La prolifération des appareils IoT modifie le mode de fonctionnement des organisations et la façon dont les consommateurs interagissent dans le monde entier. Il est passionnant de voir de telles innovations se développer. Dans le même temps, les organisations sont soumises à une pression croissante pour protéger leurs IoT et leurs appareils connectés tout en naviguant dans un paysage numérique de plus en plus complexe qui exige une confiance totale.

Les conclusions du rapport de Keyfactorréitèrent l'importance d'une sécurité fondée sur l'identité pour ceux qui fabriquent les dispositifs IoT et ceux qui les déploient et les exploitent dans leur environnement afin d'établir une confiance numérique à grande échelle.

N'attendez pas une faille de sécurité pour agir - apprenez comment renforcer la sécurité de IoT dès maintenant. Accédez au rapport complet ici.