Zscaler has released the company’s second annual Internet of Things (IoT) report, IoT Devices in the Enterprise 2020: Shadow IoT Threat Emerges. Zscaler customers are now generating more than 1 billion IoT transactions per month in the Zscaler™ cloud, which amounts to a 1,500 per cent increase since Zscaler’s May 2019 report. By analysing two weeks of this traffic through Zscaler cloud, Zscaler found 553 different IoT devices across 21 categories from 212 manufacturers.
Organisations around the world are observing this Shadow IoT phenomenon, where employees are bringing unauthorised devices into the enterprise. With this onslaught of unknown and unauthorised devices, IT and security teams often won’t know these devices are on the corporate network nor how they impact an organisation’s overall security posture.
“We have entered a new age of IoT device usage within the enterprise. Employees are exposing enterprises to a large swath of threats by using personal devices, accessing home devices, and monitoring personal entities through corporate networks,” said Deepen Desai, Vice President of Security Research, Zscaler. “As an industry, we need to implement security strategies that safeguard enterprise networks by removing shadow IoT devices from the attack surface while continuously improving detection and prevention of attacks that target these devices.”
Over the quarter, Zscaler blocked approximately 42,000 transactions which were IoT-based malware and exploits. The top malware families included Mirai, Gafgyt, Rift, Bushido, Demonbot and Pesirai. The top destinations connected to by IoT malware families and exploits are the United States, the UK, Russia, The Netherlands and Malaysia.
In response to the growing threat posed by Shadow IoT devices brought into the enterprise, IT organisations must first be able to gain visibility into the existence of unauthorised IoT devices that are already inside the network. Organisations should be considering a Zero Trust approach that ensures any communication between devices and people is with known entities and is within your organisation’s policy to reduce the IoT attack surface.