Passwords have always been one of the simplest security methods, but the presence of default passwords in the IoT (Internet of Things) is very dangerous.
Many IoT devices come set up with a default password in place which is certainly a nice option, but when that default password is the same across the entire product range then it presents a major security flaw. Say, for example, you buy an IoT fish tank (yes, these actually exist) and it shares the same default password as all other IoT fish tanks in that product range, it’s not going to take much research to discover that password, is it? Sure, it’s just as easy to change the password, but how many people would think about adjusting security settings on a fish tank?
As more and more organizations are installing IoT devices, it’s a good idea to familiarize yourself with the dangers of default passwords and how to make your passwords more secure.
Default Passwords and their Dangers
It’s estimated that 15% of IoT device owners fail to change their default password, so it’s almost certain that all medium and large businesses have at least one employee with a susceptible IoT device. It’s partly laziness on the owners’ parts and it’s partly down to IoT technology being so new that people aren’t aware of the security risks. Nonetheless, it’s presenting a major security issue for organizations as hackers are taking full advantage of the situation.
Hackers are concentrating on the construction of malware which comes preloaded with huge lists of default passwords, so that breaking through defenses becomes that little bit easier and quicker. And this is exactly what happened when the Mirai botnet managed to infect nearly 185,000 IoT devices by exploiting default passwords. Default passwords are regularly being leaked and shared online, so the importance of changing these as soon as possible should be a paramount concern for organizations.
Protecting Against Default Passwords
If you want to improve the security on your IoT devices and protect the rest of your organization’s network, then you need to take note of the following tips:
- Change the Password on a Protected Network: Before your IoT device is connected to the internet, make sure that it’s connected to an exclusive, protected network that cannot be accessed externally. This allows you to, first, test the device and, secondly, to change the password before it’s detected by IoT search engines such as Shodan.
- Run Regular Audits on All IoT Devices: Detecting and monitoring new devices on your network should become a priority. Any new and unknown devices to your network should instantly be blocked and an authentication process put in place. With this information you can then track down the device owner and ensure that any default passwords are changed before further access to the network is granted.
- Don’t Use Admin as a Username: Admin is probably the most common username used in IT departments and hackers are well aware of this. Even if you’ve changed your default password to something highly cryptic, a simple username such as ‘admin’ instantly halves the amount of work a hacker has to do.
For more ways to secure and optimize your business technology, contact your local IT professionals.
