“Insights from the Front Lines: Analyzing the Latest Device and Infrastructure Attacks Uncovered in Microsoft’s Digital Defense Report”

The increasing adoption of Internet of Things/Operational Technology (IoT/OT) by organizations holds great promise for digital transformation. However, it has also increased the number of attack vectors and the exposure risk to organizations. According to a survey conducted by Microsoft and Ponemon, 60% of respondents recognize that IoT/OT security is one of the least secured aspects of their infrastructure, which is problematic given the estimated 55.7 billion connected IoT devices by 2025.

In 2021, Microsoft found unpatched, high-severity vulnerabilities in 75% of the most common industrial controllers in customer OT networks, and reports malicious actors targeting everything from traditional IT equipment to OT controllers and simple IoT sensors. Attackers target power grids, leverage ransomware to disrupt operations, and use IoT routers for increased persistence.

## Ways to increase IoT/OT security

To address this problem, public and private sector organizations need to take a consistent and comprehensive approach to security. They should consider laws and regulations designed to build public trust in the cybersecurity of critical infrastructure and devices, and demand and implement better cybersecurity practices for IoT and OT devices. Organizations should also implement a security monitoring solution that spans IT and OT networks, and make use of five tips:

### Start with the basics

Ensure devices are robust by applying patches, changing default passreplaces, and updating default SSH ports. Reduce the attack surface by eliminating unnecessary Internet connections and open ports, restricting remote access by blocking ports, denying remote access, and using VPN services.

### Know your network

Gain deeper visibility into IoT/OT devices on your network and create a ranking system that prioritizes each device by the risk they pose if they were compromised. Use firmware scanning tools to assess potential security weaknesses and work with vendors to identify how to mitigate the risks of high-risk devices.

### Use the right tools for the job

Use an IoT/OT-aware network detection and response (NDR) solution along with a Security Information and Event Management (SIEM) /Security Orchestration and Response (SOAR) solution to monitor devices for anomalous or unauthorized behavior, such as communication with unfamiliar hosts.

### In the event of an attack, limit impact

Segment networks to limit an attacker’s ability to move laterally and compromise assets after the initial intrusion. IoT devices and OT networks should be isolated from corporate IT networks through firewalls.

### Keep information and devices secure

Avoid transferring files that contain system definitions through insecure channels and to nonessential personnel. As seen in early 2022, when the first known redeployment of OT attack malware on a new target occurred, keeping information secure is just as important as device security.

## Conclusion

As digital transformation continues to gain pace, the number of cyber threats will likewise increase. The adoption of IoT/OT holds great promise for digital transformation, yet the current threat landscape highlights that keeping devices and information secure remains a core challenge. Organizations should address this challenge through a consistent and comprehensive approach to security encompassing better cybersecurity practices, laws, and regulations that build public trust, and implementation of the five tips discussed above.