Leader in Cloud Security Frames IoT Ecosystem Across 153 Different Manufacturers.

Zscaler announced today the release of its 2019 report, IoT in the Enterprise: An Analysis of Traffic and Threats, which examines traffic stemming from IoT device footprints across the Zscaler™ cloud over the course of 30 days.

The Zscaler™ ThreatLabZ research team analyzed 56 million IoT device transactions to understand the types of devices in use, the protocols used, the locations of the servers with which they communicated, and the frequency of inbound and outbound communications.

Over a 30-day period, 56 million transactions were processed in the Zscaler cloud from 270 different types of IoT devices made by 153 different manufacturers. The analysis showed that more than 1,000 organizations have at least one IoT device transmitting data from the network to the internet via the Zscaler cloud platform.

The most commonly detected IoT device categories across the Zscaler cloud, included IP cameras, smart watches, printers, smart TVs, set top boxes, IP phones, medical devices, and data collection terminals, among others.

Highlighted findings in the report include:

• Nearly half (41%) of all unique IoT devices found in enterprise network were communicating over unencrypted channels
• Zscaler blocked approximately 6,000 transactions from IoT-based malware and exploits, including Mirai, Gafgy and Hakai
• Over the course of the one-month analysis, 56 million IoT device transactions were processed in the Zscaler cloud
• Highlighted devices observed by Zscaler include 46 different TV models, including Sony, Samsung, Philips, Panasonic and LG; 24 media players including those from Bose, Google, Sony and Roku; 109 set top boxes and DVRs including those from Amazon, Apple, Google and DIRECT TV
• Top active connected devices in the enterprise included HP and Canon printers, Roku digital players, and Zebra and Motorola data collection terminals

“As is often the case with new innovations, the use of IoT technology has moved more quickly than the mechanisms available to safeguard these devices and their users. Within only one month of traffic, our threat research team saw an astronomical amount of traffic stemming from both corporate and personal IoT devices,” said Amit Sinha, Executive Vice President of Engineering and Cloud Operations, Chief Technology Officer, Zscaler.

“Enterprises need to take steps to safeguard these devices from malware attacks and other outside threats.”

Top IoT Security Concerns:

• Weak default credentials
• Plain-text HTTP communication to a server for firmware or package updates
• Plain-text HTTP authentication
• Use of outdated libraries

Deepen Desai, Vice President of Security Research, Zscaler, said:

“We observed that over 90 percent of IoT transactions are occurring over a plain text channel, which we believe makes these devices and the enterprises that house them vulnerable to crafted attacks.”

“Enterprises need to assess their IoT footprint, as they will only continue to expand and raise the risk of cyberattacks. From changing default credentials to restricting access to IoT devices from external networks, there are a variety of steps that can be taken to increase the IoT security posture.”