A new study from the Berkeley School of Information* reports that the cost to IoT device owners whose IoT devices that were subverted into a Botnet ande used in the 2016 DDoS attack on the Krebs on Security site that knocked it offline for four days, found that it may have cost device owners a total of $323,973.75 in excess power and added bandwidth consumption or broken down amongst 24,000 attacking drones, the per-device cost comes to just $13.50. Bob Noel, Director of Strategic Relationships and Marketing at Plixer commented below.
Bob Noel, Director of Strategic Relationships and Marketing at Plixer:
“Organizations with enslaved IoT devices on their network do not experience a high enough direct cost ($13.50 per device) to force them to worry about this problem. Where awareness and concern may gain traction is through class action lawsuits filed by DDoS victims. DDoS victims can suffer financial losses running into the millions of dollars, and legal action taken against corporations that took part in the distributed attack could be mechanism to recuperate losses. Companies can reduce their risk of participating in DDoS attacks in a number of ways. They must stop deploying IoT as trusted devices, with unfettered access. IoT devices are purposed-built with a very narrow set of communication patterns. Organizations should take advantage of this and operate under a least privilege approach. Network traffic analytics should be used to baseline normal IoT device behavior and alarm on a single packet of data that deviates. In this manner it is easy to identify when an IoT device is participating as a botnet zombie, and organizations can remediate the problem and eliminate their risk of being sued.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.