The cybersecurity challenges of 5G and IoT

David Higgins, EMEA Technical Director at CyberArk, discusses how emerging IoT models and the expansion of 5G will open up a number of potential cybersecurity threats

Connectivity as a concept has become an essential part of life, as opposed to just a luxury. The Internet of Things (IoT) has already become commonplace in our lives, thanks to all the connected devices and smart technologies we own interacting with one another to create a fully connected network. Recent reports have projected that the number of these IoT devices are likely to triple in number by 2025. Furthermore, European internet penetration has increased by 20% in the last decade alone. These statistics, along with the fact that one-in-three EU member states launched commercial 5G services at the end of last year, signpost that, as a continent, we will soon be more connected than ever.

Having access to a network of devices and high-tech equipment presents the modern world with an immeasurable number of benefits – the impact of which is clearly apparent when comparing today with the world several decades ago. But hyper-connectivity does not come without its own reservations. Intrinsic to connectivity is the ability to access data and with data comes risk. Threats are boundless and multiplying every day to exploit the ever-expanding data landscape.

With Europe heading swiftly into an age of ever more enhanced connectivity, individuals and organisations need to familiarise themselves with these developing threats and the volatile environment, while ensuring that the measures taken to protect against criminal behaviour are up-to-date and suitable for the task at hand.

CSPs: Where do they sit?

Communications services providers (CSPs) specialising in mobile services, media, or web services live in a world of relentless innovation. A need to stay relevant forces CSPs to deliver value beyond basic connectivity. This opens lucrative new markets and opportunities for all industries.

The IoT industry will play a pivotal role in these innovations. The technology is on track to embed itself into countless aspects of our day to day lives, playing a pivotal role in the creation of smart cities and infrastructure, connected vehicles, digital healthcare, smart homes and more at a pace that is hard to keep up with. 5G is also being rolled out at the same time as the IoT reaches its peak, ensuring substantial potential disruption.

Similarly, Over-the-Top (OTT) businesses – content providers distributing messaging and streaming media over the internet – are thriving. Years after Yahoo! Messenger and AOL’s AIM came and went, they keep finding new ways to undermine CSPs’ business models. Tencent, the parent company of Chinese messaging platform WeChat, currently has a market cap of over £300 billion (compared to Verizon’s £190 billion) and the meteoric rise of OTT streaming players like Netflix has been well documented.

But of course, attackers will continue where there is money to be made. Cyber-attacks are on the up, and cybercriminals are becoming increasingly bold and brash, targeting anyone in any way possible. Telecoms companies are frequently targeted because they build, control, and operate critical infrastructure that is widely used to communicate and store large amounts of sensitive data for consumers, businesses, and government. Data breaches or denial of service attacks on CSPs can reverberate far beyond the initial incident. Moreover, end-user equipment – home routers, smartphones, IoT devices and more – are not entirely under CSP control. They can be easy to compromise and thus ideal targets for hackers looking to steal data.

Following a long year of social media giants battling with digital regulations, data privacy is a higher priority than ever before. Since prominent communications brands have also been implicated in major data breaches, CSPs are beginning to recognise the need to embrace trust as a competitive differentiator.

For consumers, the dramatic expansion in bandwidth and connectivity that will come with 5G technologies and emerging IoT devices will provide more options to engage with media.  It will also present new opportunities for both media providers and network operators. There’s no doubt that it’s an exciting time in the telecommunications sector.

CSPs are not, however, in such a strong position that they can ignore the risks of the data economy. Criminals are always on the hunt for new weaknesses, and will find them eventually, even in the most advanced defences.

The Achilles’ heel

The infrastructure of telecommunications organisations is inherently more exposed to hard-hitting cyber-attacks compared to other consumer-oriented organisations. Bad publicity, brand damage, and regulatory fines can cause short to medium-term damage, but an attack on a telecoms company has the potential for a much deeper impact that most other services don’t have to worry about.

Telecommunications systems are embedded so deeply within the networks of nations across the globe that their security has become paramount. They are constantly functioning as facilitators of not only financial and business transactions, but also emergency response communications, meaning that the consequences of a breach are substantial. Steps must be taken to ensure that every blunt edge in telecoms cybersecurity is sharpened and secured.

Privileged Access Management: The power to protect

Companies today look after a whole host of information and data, much of it being confidential and of critical importance. To guard this data, yet still allow certain individuals to access to it, privileged credentials exist across almost every enterprise’s IT environment. Cybercriminals know this. That is why almost all advanced attacks today gain access to a target’s most sensitive data, applications, and infrastructure by exploiting a company’s privileged credentials. Telecommunications is by no means an exception.

Despite this knowledge, organisations allow privileged access to critical assets and systems to remain unsecured and unmanaged. Assets are therefore left vulnerable to damaging cyber-attacks that could impact telecommunications companies and citizens far beyond the limits of a simple data breach.

Companies must up their game in securing, controlling, and monitoring the use of powerful privileged accounts to minimise disruptive damage to these systems.

In order to proactively reduce the risk of privileged access abuse, telecoms companies must firstly understand the most common types of attacks that exploit privileged access. They must know how an attacker thinks and behaves in each case to exploit the organisation’s vulnerabilities. They must then prioritise the most important privileged accounts, credentials, and secrets. Identifying the potential points of attack, and then focusing especially on those that could jeopardise critical infrastructure or the organisation’s most vital information is also essential.

After understanding weaknesses and access points for attackers, telecoms companies must determine the most effective actions to close the gap in these areas. Which actions are the highest priority? What can be achieved quickly, and which actions require a long-term plan?

As an overarching rule, organisations should recognise that attackers are constantly looking for new ways to gain access, and act appropriately in response. By taking the time to plan out a strategy for managing privileged access and returning to reassess it as your organisation and the threat landscape evolve, you can develop a formidable defence.

As a global society, we’re moving into an era where technology is our most important asset and tool. We are innovating the very networks that this world runs on daily, creating, in turn, services that improve our standard of living exponentially. IoT devices create a network of tools versatile and agile for human needs, and 5G connectivity will provide all of it to our fingertips. But as a shepherd tends his flock at night, so must we in keeping alert and vigilant to potential threats that can disrupt growth.

Reviewing security strategy is therefore key. By identifying privileged access-related weaknesses within the network, fortifying these weaknesses, and aiming for continuous review and improvement as a mind-set, service providers can limit the damage caused by cyber-attacks. With an approach like this, customers’ data will be best protected from emerging threats, and the benefits of connected technologies will be reaped.