Why Connected-Device Security Is Key to Expanding DOD 5G Adoption

The Defense Department is moving aggressively to expand 5G research and ultimately, deployment. In October 2020, award contracts totaling $600 million were announced by then-Acting Under Secretary of Defense for Research and Engineering Michael Kratsios to perform testing and evaluation of 5G technologies at five military installations across the country.  

The benefits of 5G across DOD and battlefield environments are expected to stretch far and wide. But as is often the case with digital transformation, there are choppy waters to navigate. More connected internet-of-things devices, sensors and endpoints mean an expanded attack surface and an opportunity for adversaries and other bad actors to exploit security vulnerabilities. Securing IoT devices across the DOD is even more essential given the recent passage of the IoT Cybersecurity Improvement Act.

To maximize the benefits of 5G, DOD must minimize associated security risks. A core challenge to addressing these risks as 5G deployments continue, according to former Secretary of Defense Mark Esper, is ensuring those systems—as well as those of our allies and partners—are robust, protected, resilient and reliable. This means the DOD must build a scalable IoT security infrastructure to support hyper-connected environments.

Strategies to Secure IoT 

We are seeing encouraging moves by DOD to unlock greater government-industry potential with the private sector through efforts like AFWERX—a DOD acquisition initiative spearheaded by the Air Force that aims to expand technology, talent and transition partnerships to enable the defense community to rapidly and affordably acquire new technologies. Some recent contracts have sought to secure IoT technologies at scale. 

The stakes of IoT security and the urgency of addressing vulnerabilities were reinforced when hackers breached Verkada security cameras in March. Hackers gained access to feeds from nearly 150,000 cameras, as well as the full video archive from Verkada customers. 

Video cameras are just one example of the litany of new attack surfaces which hackers can take advantage of. The department deploys a far broader landscape of internet-connected devices, and the risks associated with these devices are not lost on DOD 5G stakeholders. To ensure 5G-enabled IoT networks deployed across DOD are architected to be secure and resilient, consider the following strategies:  

• Adopt solutions that don’t require “rip and replace.” It is rarely feasible for government agencies to dismantle their entire network infrastructure in an attempt to better secure it. Officials need efficient, non-invasive and scalable solutions to close the IoT security gap for the existing IoT environment and as it evolves. This means solutions that easily integrate into their existing security environments; provide comprehensive visibility into an organization’s network to understand every single device that is operating on their network; and those that can easily complete important tasks such as policy enforcement, patching and password updates so valuable cybersecurity talent can be deployed to other pressing matters. 
• Adopt IoT cyber hygiene. Hardcoded administrative credentials and passwords make it easy for hackers to access devices and their data. The DOD must put in place basic, scalable security hygiene measures to protect IoT devices, such as inventory, patching and credential management, as well as automating remediation against IoT’s most critical vulnerabilities. 
• Automate when possible. Automating security is critical to scaling IoT technologies without the need to scale headcount to secure them. By automating security, organizations can keep pace with the proliferation of IoT technologies without overtaxing IT teams. Automating also is needed for policy compliance and enforcement by patching firmware and updating passwords, defending your IoT as thoroughly as your other endpoints. Finally, you need to automate detection of new IoT devices as they join the 5G-enabled DOD network, so shadow IoT doesn’t create unseen vulnerabilities.
• Avoid flying blind. DOD security managers and IT personnel need visibility and awareness of every connected device. This requires collecting data from every device to be able to “see” every IoT device and defend every Thing.
• The right technology approaches. There is growing interest within the public sector for zero-trust cybersecurity—an approach optimally suited for IoT security. A zero-trust approach to data security means treating every device and connection inside your network the same as you would an attempted connection outside of the network. When it comes to managing security of IoT devices, a zero-trust approach can stop illegitimate data access if an IoT device inside the network is compromised.

Government and commercial organizations are still trying to get a handle on their current IoT device footprint and account for all the devices on their network. When we talk about significantly expanding the volume of devices, it will be critical to do so while putting the right security processes, technologies and strategies in place. Couple this with a massive increase in IoT hacking, and it’s easy to see why there is such a glaring need for organizations to invest in tools that secure their “Things.”

Chris Rouland is a founder and chief executive officer of Phosphorus.