• Skip to Content
  • Skip to Navigation
  • Skip to Footer
  • Skip to Cookie Settings
Wipro Logo
What We Do
What We Do
Services
Applications Artificial Intelligence Business Process Services Cloud Consulting Cybersecurity Data & Analytics Digital Experiences Engineering Sustainability
Industries
Banking & Financial Services
›
Banking Capital Markets Insurance
Comms, Media & Information Services
›
Communications Media & Info Services
Consumer
›
Consumer Packaged Goods Education Professional Services Public Sector Retail Travel, Transportation, Hospitality and Services
Energy, Manufacturing and Resources
›
Aerospace & Defense Automotive Engineering Construction Operations Industrial & Process Manufacturing Natural Resources Oil & Gas Utilities
Hi-Tech
›
Consumer Electronics Semiconductors
Technology Products and Services
›
Network & Edge Providers
Healthcare Life Sciences & Pharma Medical Devices Platforms, Software Products and Gaming
Services
Applications Artificial Intelligence Business Process Services Cloud Consulting Cybersecurity Data & Analytics Digital Experiences Engineering Sustainability
Industries
Banking & Financial Services
Banking Capital Markets Insurance
Comms, Media & Information Services
Communications Media & Info Services
Consumer
Consumer Packaged Goods Education Professional Services Public Sector Retail Travel, Transportation, Hospitality and Services
Energy, Manufacturing and Resources
Aerospace & Defense Automotive Engineering Construction Operations Industrial & Process Manufacturing Natural Resources Oil & Gas Utilities
Hi-Tech
Consumer Electronics Semiconductors
Technology Products and Services
Network & Edge Providers
Healthcare Life Sciences & Pharma Medical Devices Platforms, Software Products and Gaming
What We Think
About Wipro
About Wipro
About Us Analyst Reports Awards and Recognitions Case Studies Corporate Sustainability Events
Inclusion and Belonging Investors Leadership Locations News Partner Ecosystem
Privacy at Wipro Supplier Diversity Wipro Innovation Network Wipro Ventures Wipro Wellbeing
About Us Analyst Reports Awards and Recognitions Case Studies Corporate Sustainability Events
Inclusion and Belonging Investors Leadership Locations News Partner Ecosystem
Privacy at Wipro Supplier Diversity Wipro Innovation Network Wipro Ventures Wipro Wellbeing
Careers
Contact Us
Wipro IG Linkedin Wipro

Europe ›

Europe Sub Menu Opened
  • Benelux en
  • Europe en | de
  • Germany & Austria en | de
  • Nordic en
  • Southern Europe en | fr
  • United Kingdom & Ireland en

Americas ›

Americas Sub Menu Opened
  • Brazil en | pt
  • Canada en | fr
  • Latam en
  • Mexico en | es
  • United States en

Asia & Pacific ›

Asia & Pacific Sub Menu Opened
  • Asean en
  • Australia & New Zealand en
  • China en
  • Japan en | ja
  • Korea en
  • Taiwan en

India & Middle East ›

India & Middle East Sub Menu Opened
  • India en
  • Middle East en

Africa

Is your CISO ready for the internet

of (insecure) things?

microsites_play_icon
X

microsites_play_icon
popup-image

Last July, a security firm discovered cybercriminals had stolen a casino's data by hacking into one of its aquariums. The aquarium's low-security internet-connected thermostat gave hackers a foothold in the casino's network. Once there, they accessed the high-roller database and pulled that data back out from the thermostat and up to the cloud.

Businesses are integrating IoT devices into every area of operation-from factory floor sensors that detect vibrations to desks that automatically alert employees to take a break from sitting. IoT could soon be as much a part of corporate IT infrastructure as PCs.

However, in a rush to adopt this next iteration of digital transformation, companies are forgetting to consult their CISOs. As IoT connects physical with cyber, companies' digital footprints are expanding exponentially, providing more and more vulnerabilities for attackers to exploit. A survey found that almost 20% of organizations had at least one IoT-related attack in the past three years.

Stripped down for performance, not security

By design, IoT devices have little memory-typically too little for security add-ons. The demands of mobility, extended battery life, and price margins keep IoT sensors lean but defenseless.

That isn't all. IoT software rarely allows for automatic patches, which goes against cybersecurity's first commandment: patch immediately. This was the harsh reality learned by victims of 2017's WannaCry ransomware attack, which infected organizations that lacked an available software patch. IoT devices may also have pre-loaded, unchangeable passwords-a vulnerability 2016's massive Mirai botnet exploited by scanning for IoT devices that were still set to factory-default login information. Just one well-known vulnerability, called DNS rebinding, is estimated to affect half a billion IoT devices in businesses. A sampling of IoT devices found 83% hadn't yet patched against known threats.

The multitude of IoT devices, running a multitude of software platforms, complicates CISOs' jobs and should raise alarm with CEOs. An attack via IoT could be catastrophic, according to 97% of firms surveyed. The healthcare industry is especially at risk, finishing as 2017's biggest victim of data breaches. While in 2016 30% of the attacks targeted the healthcare industry, in 2017 the number jumped to 41%. That percentage is likely to continue rising as healthcare IoT expands. A report by Allied Market Research predicts that the IoT healthcare market will reach $136.8 billion worldwide by 2021.

So what's a CISO to do? Here's some good news: 74% of organizations have IoT security assessment controls in place already, and just over 60% of organizations have password protected their IoT devices.

But the scale of the IoT security challenge requires an additional two-tiered approach: automate and institutionalize. The former assures fast and routine controls across thousands of tiny IoT sensors. The latter curtails risks from the get-go and ensures CISOs can develop their tools as hacking gets more sophisticated.

Automation: fighting botnets with bots

Automated security takes several forms. Automated platforms can look for "Indicators of Compromise," check VPNs, and detect and shut down intrusions in progress. Using artificial intelligence, automated security platforms can spot abnormal activity-the rogue fish tank was uncovered because it was the casino's only device sending data to Finland. The number of companies using "Security Orchestration, Automation, and Response" tools is expected to jump to 15% in 2020, from 1% in 2017.

New security automation solutions will be able to "speak" to IoT devices, even very simple ones like CCTV cameras or biometric sensors. This is important, considering the incredible variety of IoT devices, and the fact that they often are deployed in large numbers. Automated software is being developed that could reach out and patch any device as soon as a vulnerability is discovered. One example, called Mayhem, won a Pentagon contest to create automated patching.

In the meantime, machine authentication verifies any device connecting to your network at a more sophisticated level than simply username and password, instead using a digital certificate that will stop your thermostat from talking to a hacker.

Getting security into the institution's DNA

But automation isn't enough. IoT should undergo the same due diligence that any IT infrastructure gets. A building supervisor installing a smart electronic key system, a product engineer choosing IoT components, or a casino manager adding a smart thermometer to a fish tank today are not likely to ponder over the security of their selections. Those decisions should be made under a CISO's institutionalized supervision. To ensure technological advances don't introduce security flaws, CISOs and their tools should be part of purchasing, designing, or implementing all technological transformations, including IoT.

This requires a paradigmatic shift in the CISOs' role; they shouldn't be siloed within an organization, but rather should be involved in all aspects of an institution-from employee training to vendor selection. The lack of standardization in innovative hardware and software like IoT means that security especially needs to be baked in from the moment a company even considers adding sensors or smart devices-before any purchase is made.

Integrating security from the beginning also keeps security from being seen as a hindrance to innovation. As more smart lights, smart cameras, smart printers, and smart aquariums are compromised, people will see that what's really smart is to make sure connected devices are secure from the start.

It's one thing to adopt innovative technology. It's another to deploy that technology smartly and safely.

© 2025 Wipro
  • Disclaimer
  • Privacy
  • Modern Slavery Statement
  • X

    Share Icon
    popup-image

    Contact Wipro

    Please fill the required details to access the content

    loading.gif