A Zscaler report finds 91.5% of IoT communications within enterprises are in plaintext and so susceptible to interference. Credit: HYWARDS / Getty Images Of the millions of enterprise-IoT transactions examined in a recent study, the vast majority were sent without benefit of encryption, leaving the data vulnerable to theft and tampering. The research by cloud-based security provider Zscaler found that about 91.5 percent of transactions by internet of things devices took place over plaintext, while 8.5 percent were encrypted with SSL. That means if attackers could intercept the unencrypted traffic, they’d be able to read it and possibly alter it, then deliver it as if it had not been changed. Researchers looked through one month’s worth of enterprise traffic traversing Zscaler’s cloud seeking the digital footprints of IoT devices. It found and analyzed 56 million IoT-device transactions over that time, and identified the type of devices, protocols they used, the servers they communicated with, how often communication went in and out and general IoT traffic patterns. The team tried to find out which devices generate the most traffic and the threats they face. It discovered that 1,015 organizations had at least one IoT device. The most common devices were set-top boxes (52 percent), then smart TVs (17 percent), wearables (8 percent), data-collection terminals (8 percent), printers (7 percent), IP cameras and phones (5 percent) and medical devices (1 percent). While they represented only 8 percent of the devices, data-collection terminals generated 80 percent of the traffic. The breakdown is that 18 percent of the IoT devices use SSL to communicate all the time, and of the remaining 82 percent, half used it part of the time and half never used it. The study also found cases of plaintext HTTP being used to authenticate devices and to update software and firmware, as well as use of outdated crypto libraries and weak default credentials. While IoT devices are common in enterprises, “many of the devices are employee owned, and this is just one of the reasons they are a security concern,” the report says. Without strict policies and enforcement, these devices represent potential vulnerabilities. Another reason employee-owned IoT devices are a concern is that many businesses don’t consider them a threat because no data is stored on them. But if the data they gather is transmitted insecurely, it is at risk. 5 tips to protect enterprise IoT Zscaler recommends these security precautions: Change default credentials to something more secure. As employees bring in devices, encourage them to use strong passwords and to keep their firmware current. Isolate IoT devices on networks and restrict inbound and outbound network traffic. Restrict access to IoT devices from external networks and block unnecessary ports from external access. Apply regular security and firmware updates to IoT devices, and secure network traffic. Deploy tools to gain visibility of shadow-IoT devices already inside the network so they can be protected. Related content news AWS clarifies Nvidia chip order: Upgrade, not halt AWS will use Nvidia’s new Blackwell GPUs for Project Ceiba instead of Nvidia’s Grace Hopper chips that were earlier planned. By Gyana Swain May 22, 2024 3 mins Amazon Web Services news SolarWinds debuts AI framework in its service desk product SolarWinds AI will first be put to use in its service desk solution to improve service agent workflows and reduce the time it takes to resolve tickets. By Denise Dubie May 21, 2024 4 mins Network Management Software Network Monitoring news Broadcom launches 400G Ethernet adapters The highly scalable, low-power 400G PCIe Gen 5.0 Ethernet adapters are designed for AI in the data center. By Andy Patrizio May 21, 2024 3 mins CPUs and Processors Networking news Microsoft Build 2024: Cloud infra updates include Cobalt 100-based VMs, access to Copilot in Azure Azure Compute Fleet, a new service designed to simplify Azure provisioning, is also among the cloud infrastructure updates unveiled at Microsoft's Build 2024 event in Seattle. By Anirban Ghoshal May 21, 2024 3 mins Server Virtualization Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe