- IoT in the company is a great responsibility the British government claims
- Most organizations run old and outdated software
- They also do not adhere to security standards
Internet of Things (IoT) devices in the company are a great security responsibility. This is according to a new report from Cybersecurity Professionals NCC Group on behalf of the British government.
“The government is concerned about the security of these products, as vulnerable entities can provide a route to enemy players to attack the IT systems used by companies,” the British government said in a report of the report. “As part of the government’s work on tackling this issue and improving cyberresilience over the British economy, the government ordered the NCC group to conduct a vulnerability assessment of some commonly used company-associated units.”
The results have shown that British companies have plenty of reasons to be concerned. Apparently, NCC Group found a “number” of software and hardware vulnerability that could lead to Remote Code Execution (RCE) attacks that gave threat actors full control over a device over the network.
Outdated software
One of the bigger problems was outdated software. The report states that non-confined solutions were “widespread across devices” and indicated that one of the analyzed devices was running a 15-year bootloader.
The British government also said that in “most cases” an attacker with physical access to a device would be able to fully compromise on it and install a lasting back door to be used in future attacks. Most of the devices tested ran all their processes as the highly privileged “root” user, which means there is no granulation and the consequences of a violation may be bleak.
There is nothing particularly unique about these IoT devices or the vulnerabilities they wore. The British government said they were “generally uncertain”, especially when it comes to configuration of services, applications or features. It also warned that compliance with NCSC’s unit security principles and ETSI EN 303 465 standard was “mixed”.
