Adopt the “G.I. Joe” Philosophy of Securing Rogue Devices

The perception that you only need to monitor traffic that’s happening on your network is extremely limiting, since customers are communicating “out of band” on many channels—such as Wi-Fi and Bluetooth—that you may not be monitoring, said Jayson E. Street (@jaysonstreet), infosec ranger at Pwnie Express in our conversation at the 2015 RSA Conference in San Francisco.

There are tons of rogue devices hitting your network that you may not know about: devices like a Wi-Fi access point, helicopter drone, networked lightbulb, or smart thermostat. These devices are accessing your network but aren’t visible through traditional internal network monitoring.

“[Unbeknownst to you,] you’ve got employees who are, for all the best intentions, putting in a wireless access point unencrypted in the conference room so that they can be better at work. They don’t realize that now an attacker can use that to pivot into their network and take that data out that never triggers an IDS system, that never triggers a firewall, and then all your data is gone,” warned Street.

“These are all pivot points. These are all devices whose main intention is not to be malicious, but it can be turned very quickly into a malicious device from an attacker,” said Street.

To learn more about how a rogue device could be used against you, check out Pwnie Express’ independent report, The Internet of Evil Things.

“Many of these things come with no security capability, where you can’t lock it down if you wanted to. It’s just the awareness of it. Just like G.I. Joe, ‘Knowing is half the battle,’” Street said.

What you need is a notification that someone put something on your network and you can combat it and respond to it, said Street. That’s a lot better than finding out weeks or months later from a breach report.