With enterprise IoT proving a game-changer for operations optimization and staff efficiency, many companies choose to foray into it and upgrade their traditional workplace to a smart office
Among the many efforts for ensuring the transformation is fruitful and sustainable, IoT testing targeted at the network and system security ranks high.
Zero trust, a security model that implies no person or device, either from the inside or outside the network, should be trusted by default until verified. It offers a significant departure from the traditional “castle-and-moat” approach.
Yet, for a workplace equipped with hundreds of unmanaged internet-connected devices that generally lack adequate built-in protection mechanisms, the change turns out pivotal for forestalling both insider and outsider threats. What is more, such a borderless security strategy can accommodate an expanding and evolving smart office infrastructure better and mitigate the vulnerabilities emerging from the shift to remote work.
Below is an actionable four-step guide to help enterprise owners implement a zero-trust model into their IoT-enabled workplace.
Step 1. Attain a full infrastructure visibility
A well-defined protect surface, or the scope of devices, data, and software that need protection, is the cornerstone of a zero-trust architecture. Unfortunately, the so-called shadow IoT, or unsupervised connected assets in active use, is a common plague of smart office environments replete with smart devices ranging from HVAC and CCTV cameras to vending machines and kitchen appliances.
A comprehensive IoT device management process can allow companies to gain the required level of control over their connected environments. First and foremost, it starts with discovering every connected endpoint in the smart office, either manually or utilizing dedicated software, and creating a unified inventory by noting down the devices’ types, IP addresses, models, vendors, settings, security controls, ownership, and other specifics.
IT specialists should also maintain a real-time view of the network’s topology, and how endpoints communicate with external systems and between each other. Last but not least, to remain relevant down the line, the inventory needs to be updated when there is a sufficient infrastructure change.
When having a fully visible and controllable IoT environment where every connected device, sensor, and endpoint, as well as their communications, configurations, and vulnerabilities, are accounted for, security teams can adopt protection measures tailored to network specifics and device vulnerabilities and streamline equipment updates and maintenance.
Step 2. Introduce access controls and authentication measures
In traditional security architectures, everyone inside a protected perimeter is considered trustworthy and provided unrestricted access to the network and devices. A zero-trust model defies this blanket approach with the “never trust, always verify” principle, which states that each user has their scope of access permissions and should always, no matter how high-ranked they are, confirm their credentials to access required resources.
But first, you need to ensure that the right people have the right level of access. Role-based access controls (RBAC), or granting each individual just enough device permissions to perform their job tasks, proves to be the most sustainable arrangement for IoT environments. With employees coming and going and being promoted, it is important to keep the RBAC system up to date to prevent security compromise.
After imposing granular access controls, you should proceed with introducing proper user authentication methods. While virtual access to connected devices and software can be restricted with multi-factor authentication and passwords (other than off-the-shelf credentials), matters get trickier when it comes to the devices’ physical security. To limit access to the spaces heavily equipped with smart devices, such as meeting rooms or conference halls, you can retrofit the doors with smart biometric locks.
Step 3. Segment the network
Another critical characteristic of a zero-trust architecture is a segmented environment. In the traditional workplace, all devices are kept within a single flat network, which is a sound and maintenance-friendly arrangement when the number of internet-connected endpoints is low.
However, when office premises grow abundant with smart devices for different purposes, inventorying such a vast infrastructure becomes a taxing task, and the risk of security faults going unnoticed increases. Beyond this, an unsegmented smart office becomes a single attack surface, where one vulnerability can prove enough to sabotage the whole network.
To protect your workplace from these risks, the IT security team needs to separate a single network into multiple isolated domains. It is an established practice to keep IoT and non-IoT devices apart and group same-type endpoints together. Also, if your company encourages the BYOD trend or remote work, you will need dedicated networks for non-corporate devices.
About the Author
Vitaly Prus is a certified Scrum Master and Head of the Agile Testing Department at a1qa, software testing company. Vitaly manages the team of 60 QA Engineers who have successfully completed over 30 projects. Founded in 2003, a1qa is a 800+ strong independent software quality assurance provider offering full-cycle testing services, including QA audits and consulting, test automation, and QA outsourcing.
Featured image: ©leungchopan
