Who will you permit to access your network?

  • Aki Anttila

The Internet of Things boom has led to a situation where more and more devices are equipped with a network connection. At home, such devices can include gaming consoles, TVs, refrigerators, small kitchen appliances, washing machines, surveillance cameras and baby monitors. For them, the situation is very problematic, because typical home users are not able to understand their operation at a network level, and normally the user IDs and passwords are those given by default, if they can be changed in the first place. This vulnerability was exploited a few weeks ago by a global DDoS attack (Distributed Denial of Service), which involved an estimated 100,000 mainly consumer devices generating an attack traffic of up to 1.2 terabits per second. The target of the attack was the Internet’s DNS (Domain Name System) infrastructure which forms the foundation for a large number of services used by end users.

It is relatively challenging for a home consumer to change the operation of such devices, so the responsibility for the prevention of attacks largely lies with their manufacturers and the operators serving the consumers. Manufacturers should regard security, not as a “necessary evil”, but as something that could be used to differentiate their products and to gain a competitive advantage. Operators in turn should ensure at the gateway level that consumer networks do not let through sizable amounts of attack traffic. This is, of course, quite challenging, because the prices of gateway devices in consumer equipment have been pushed so low that their properties are somewhere between hilarious and ridiculous when it comes to today’s security requirements. Ultimately, however, these devices and the way they are used are the responsibility of the end user, whether an ordinary consumer or a business person. For this reason, it is important to try to identify devices equipped with potentially inadequate security features that may endanger not only the end user, but also a large number of other Internet users.

Although this Mirai botnet attack started mainly from consumer devices, there are similar problems also in corporate networks. An increasing proportion of equipment used in companies is connected to the Internet one way or another. In addition to relatively standard office equipment, such as printers, refrigerators and the like, a large number of production equipment currently include a component that needs to connect to the outside world. Typically, this component is added by the manufacturer to provide services related to the condition of the device, predictive maintenance, remote maintenance, etc.

Traditionally, devices have been given remote access through, for example, separate Internet connections. Therefore, the wiring cabinets of production plants in particular may hold a multitude of operator devices of whose connections no one has an inkling. No one knows where the connections go and what their level of security is. At worst, the production device is connected through one wire to some suspicious Internet site and through another wire to the internal network of the plant. So the only thing that remains between the unsafe outer network and the production network is the computer used by the equipment manufacturer, possibly an old Windows machine with no updates installed.

Since we cannot turn the clock back, we should consider how we can build a secure centralized solution for the remote connections of such devices. The building process includes five main steps: assessment of needs, modeling of solutions, making a decision, implementing the system, and transferring connections to the new platform.

During the needs assessment stage, we go through all the existing devices that require connections and anticipate future needs. Although the existing equipment may not need more than a light remote connection in the form of an RDP session for instance, it may be that, in the future, predictive maintenance will require an HD camera connection for monitoring the wear of parts, for example. All these needs are documented and alternative solutions based on them are considered. Typically, a few possible solutions are found, each having its pros and cons. The actual decision-making process is based on a realistic view of the different options.

When a decision has been made, the desired system is built. During this process, it is sometimes necessary to change existing network structures to ensure that the new remote access system functions in the desired manner. Sometimes the new package slips in without any special measures. The final step is to move the devices with separate Internet connections to the new and secure system.

Doing everything described above may take 3-6 calendar months, rarely less and sometimes more. The organization itself may have the resources needed to carry this out, and if not, there are service companies, such as Santa Monica Networks Oy, that are happy to help. Our experienced consultants have created several similar solutions and can make an offer, on the basis of the needs assessment, for removing separate, unsafe connections from the network and upgrading remote management of devices.