IoT Security: The Expanding Attack Surface in Smart Organizations

The Internet of Things has transformed workplaces, factories, hospitals, and cities into networks of connected devices that generate data, automate processes, and enable new capabilities. But the rapid proliferation of IoT devices has dramatically expanded the attack surface available to threat actors. Gartner estimates that over 25 billion IoT devices are connected globally, and many of them were designed with functionality and cost as primary considerations, not security. The result is an environment filled with devices that are difficult to secure, hard to monitor, and often invisible to IT teams. Understanding the IoT threat landscape and implementing practical defense strategies is essential for any organization that relies on connected devices.

The IoT Threat Landscape

IoT devices share a set of characteristics that make them fundamentally different from traditional IT endpoints. These characteristics create unique security challenges that require purpose-built solutions rather than adaptations of enterprise security tools.

Default Credentials

The single most common IoT security weakness is the use of default usernames and passwords. Many devices ship with credentials like admin/admin or root/password, and users never change them. The Mirai botnet exploited exactly this weakness, scanning the internet for devices with default Telnet credentials and enslaving hundreds of thousands of cameras, routers, and DVRs. Despite widespread awareness of this issue, default credentials remain prevalent because manufacturers prioritize ease of setup over security, and many IoT devices lack user interfaces that make credential changes intuitive.

Unencrypted Communications

A significant percentage of IoT devices transmit data in plaintext over the network. Sensor readings, device commands, authentication tokens, and firmware updates often travel without encryption. This allows attackers on the same network segment to intercept sensitive data, capture credentials, and inject malicious commands. Even devices that claim to use encryption often implement it incorrectly, relying on outdated TLS versions, hardcoded certificates, or weak cipher suites.

Lack of Update Mechanisms

Many IoT devices have no mechanism for receiving firmware updates after deployment. Others support updates but require manual intervention that users rarely perform. When vulnerabilities are discovered in these devices, there is no practical way to remediate them without replacing the hardware. This creates a growing population of permanently vulnerable devices on enterprise networks. Some manufacturers abandon support for devices within a few years of sale, leaving customers with unsupported hardware that cannot be patched.

Limited Processing Power

IoT devices are designed to be small, inexpensive, and energy-efficient. This means they often lack the CPU, memory, and storage needed to run traditional security agents. You cannot install an endpoint detection and response client on a temperature sensor or a smart light bulb. Security controls must be implemented at the network level or through lightweight protocols that do not burden the device itself.

Long Device Lifecycles

While smartphones and laptops are replaced every few years, IoT devices often remain in operation for a decade or more. Building management systems, industrial controllers, and security cameras are long-lived assets that outlast their manufacturer’s support commitment. A device deployed in 2020 may still be operating in 2035, long after its security software has become obsolete and its manufacturer has disappeared.

Massive Scale

Enterprise environments may contain thousands or tens of thousands of IoT devices. Managing security across this population is a logistical challenge that overwhelms traditional IT management approaches. Manual configuration, patching, and monitoring do not scale. Automated discovery, inventory, and policy enforcement become necessities, not luxuries.

Real-World IoT Attacks

The theoretical risks of IoT insecurity have been demonstrated in devastating real-world attacks that caused physical disruption, privacy violations, and threats to public safety.

The Mirai Botnet

In October 2016, the Mirai botnet launched a distributed denial-of-service attack that reached 1.2 Tbps, overwhelming DNS provider Dyn and taking down major websites including Twitter, Netflix, Reddit, and GitHub. Mirai enslaved approximately 600,000 IoT devices by scanning for default Telnet credentials. The source code was subsequently released publicly, spawning dozens of variants that continue to operate today. Mirai demonstrated that IoT devices are not just a theoretical risk: they are a practical weapon that can disrupt critical internet infrastructure.

The Verkada Camera Breach

In March 2021, attackers gained access to over 150,000 security cameras operated by Verkada, a cloud-based surveillance company. The compromised cameras were deployed in hospitals, prisons, schools, police departments, and companies including Tesla and Cloudflare. The attackers accessed live video feeds, archived footage, and facial recognition data. The breach exposed the risks of centralized cloud management platforms for IoT devices: a single point of compromise can cascade across an entire customer base.

The Oldsmar Water Treatment Plant

In February 2021, an attacker gained remote access to the water treatment system in Oldsmar, Florida, and attempted to increase sodium hydroxide (lye) levels to dangerous concentrations. The attack exploited an exposed remote access tool that operators used for legitimate maintenance. While an alert operator noticed the change and reverted it before any contamination occurred, the incident highlighted the life-safety implications of IoT security failures in critical infrastructure.

IoT in Enterprise Environments

Enterprise IoT deployments span multiple categories, each with distinct security characteristics and challenges.

Smart Building Systems

Modern commercial buildings contain extensive networks of connected devices: HVAC controllers, lighting systems, access control panels, surveillance cameras, elevator management systems, and energy meters. These Building Automation Systems (BAS) often run on legacy protocols like BACnet and Modbus that were designed for reliability, not security. A compromised BAS can be used to manipulate physical access, disable surveillance, alter environmental conditions, or serve as a pivot point into the corporate IT network.

Industrial IoT and SCADA/ICS

Industrial IoT connects operational technology (OT) environments to IT networks, enabling remote monitoring and control of manufacturing processes, power generation, water treatment, and transportation systems. SCADA and ICS systems were historically air-gapped from IT networks, but the drive for operational visibility has connected them to enterprise networks and the internet. The Stuxnet attack demonstrated that compromised industrial control systems can cause physical destruction. In the IoT era, the attack surface for industrial systems has expanded dramatically.

Medical IoT

Healthcare IoT includes patient monitors, infusion pumps, imaging systems, smart beds, and wearable health devices. These devices directly interact with patients, and a security compromise can have immediate clinical consequences. Medical IoT devices face additional challenges: they often run on outdated operating systems, cannot be easily patched during patient use, and must comply with FDA regulations that slow the update cycle. The convergence of IT and clinical networks in hospitals means that a compromised medical device can serve as a gateway to the broader healthcare network.

Security Strategies for IoT

Securing IoT requires a layered approach that compensates for the limited security capabilities of devices themselves by implementing strong controls at the network, management, and monitoring layers.

Network Segmentation and VLANs

The single most impactful IoT security control is network segmentation. Place IoT devices on dedicated VLANs separated from the corporate IT network and from each other. A smart thermostat should not be on the same network segment as a surveillance camera, and neither should be on the same segment as employee workstations. Implement strict firewall rules between segments, allowing only the specific traffic patterns each device type requires. Use 802.1X authentication to ensure that only authorized devices can connect to IoT network segments. This segmentation limits lateral movement and contains the blast radius of a compromised device.

Device Inventory and Lifecycle Management

You cannot secure what you cannot see. Implement automated device discovery and inventory that continuously identifies every device on the network, classifies it by type and vendor, tracks its firmware version, and monitors its communication patterns. Maintain a complete lifecycle record for each device, including its deployment date, expected end-of-life, last firmware update, and vulnerability status. Retire devices when they reach end-of-life or when the manufacturer ceases security support, even if the device is still functional.

Certificate-Based Authentication

Replace default credentials and shared secrets with certificate-based mutual authentication. X.509 certificates provide strong, scalable identity verification without the risk of default or weak passwords. Use a public key infrastructure (PKI) to issue, manage, and revoke device certificates. Many modern IoT platforms support certificate-based authentication, and protocols like MQTT and CoAP can be configured to require mutual TLS with client certificates. This approach eliminates the Mirai-class attack vector entirely.

Firmware Update Management

Establish a firmware update management process that includes vulnerability monitoring, update testing, staged deployment, and rollback capabilities. Subscribe to vendor security advisories and CVE feeds for every IoT vendor in your environment. Test firmware updates in a lab environment before deploying to production devices. Use over-the-air (OTA) update capabilities where available, and automate the update process to ensure that patches are applied promptly. When a device can no longer receive firmware updates, document it as a risk and implement compensating controls such as enhanced network monitoring.

Monitoring for Anomalous IoT Traffic

IoT devices have predictable communication patterns. A temperature sensor sends data to a specific server on a regular interval using a specific protocol. Any deviation from this baseline (an unexpected destination, a different protocol, a spike in traffic volume) indicates potential compromise. Deploy network detection and response (NDR) solutions that understand IoT protocols and can baseline device behavior. Configure alerts for anomalous connections, lateral movement attempts, and communication with known-bad IP addresses. Combine network monitoring with DNS logging to detect command-and-control callbacks from compromised IoT devices.

Conclusion

IoT security is not a problem that will solve itself. As organizations deploy more connected devices, the attack surface expands faster than most security teams can respond. The organizations that succeed will be those that treat IoT security as a first-class concern, implement strong network segmentation, maintain rigorous device inventory, and deploy behavioral monitoring that compensates for the limited security capabilities of the devices themselves. The expanding attack surface demands expanding defenses. The time to act is before the next Mirai, not after.