# How can the financial sector safely use the IoT? Author: Pal Sinha, Barnali Author URL: https://financedigest.com/author/pal-sinha-barnali Published: 2022-09-07 Category: TECHNOLOGY Category URL: https://financedigest.com/category/technology Meta Title: Financial Sector IoT Security Risks and Solutions Meta Description: Discover how the financial sector can leverage IoT technology while mitigating cyber risks. Insights from Chief Security Architect, Sunil Ravi. URL: https://financedigest.com/how-can-the-financial-sector-safely-use-the-iothtml ![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/a-29784-78-180-1736815272284-compressed.jpg) ![](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/sunil-ravi-450x599-1736815272264-compressed.jpg) _By_ **_Sunil Ravi,_** _Chief Security Architect at_ [_Versa Networks_](https://versa-networks.com/) The Internet of Things (IoT) has become one of the most popular tech trends. But connected devices can create cyber risk unless properly managed. We ask Sunil Ravi, Chief Security Architect at [Versa Networks](https://versa-networks.com/) _,_ how the financial sector can best make use of IoT without creating unnecessary cyber risk. **What is IoT, and how is it being used in the financial sector?** The [Internet of Things](https://www.financedigest.com/2017-the-year-of-the-internet-of-some-things.html "2017 – The year of the Internet of ‘SOME’ Things") is a blanket term for any device with network connectivity, covering everything from industrial sensors to consumer gadgets. The [technology has proven to be extremely useful for automation](https://www.financedigest.com/being-nimble-and-responsive-in-banking-and-business-has-arrived-thanks-to-accounting-automation-technologies.html "Being Nimble and Responsive in Banking and Business Has Arrived, Thanks to Accounting Automation Technologies") and data collection, and the number of IoT devices has exploded over the last few years. Telecoms giant [Ericsson](https://versa-networks.com/resources/webinars/how-to-build-an-iot-device-management-and-security-program.php) for example estimates that there will be more than 1.5 billion IoT devices with cellular connections by the end of this year. The technology isn’t as critical for [financial services as it is in other sectors](https://www.financedigest.com/how-big-data-is-sending-shockwaves-through-the-financial-services-sector.html "How big data is sending shockwaves through the financial services sector") like manufacturing and energy, but there are still many valuable use cases for deploying connected devices. [Retail banking](https://www.financedigest.com/uk-retail-banks-is-irrelevance-curtailing-opportunity.html "UK Retail Banks: Is Irrelevance Curtailing Opportunity?") is perhaps the clearest example. IoT technology enables [banks to furnish their branches with terminals and sensors to provide better customer](https://www.financedigest.com/christmas-debt-hangovers-how-banks-can-help-customers.html "CHRISTMAS DEBT HANGOVERS: HOW BANKS CAN HELP CUSTOMERS") support and track the performance of equipment like ATMs. [Insurance firms](https://www.financedigest.com/digital-marketing-for-finance-and-insurance-firms-is-changing-are-you-ready.html "Digital marketing for finance and insurance firms is changing — Are you ready?") can also install IoT sensors for services usage-based-insurance or pay-as-you-drive policies. **What are the security issues with IoT?** The greatest risk with IoT is the [fact that it rapidly expands](https://www.financedigest.com/doppler-ultrasound-market-value-projected-to-expand-during-2021-2031-fact-mr-report.html "Doppler Ultrasound Market Value Projected to Expand during 2021-2031: Fact.MR Report") the company’s IT estate – and therefore its attack surface. Each new connected device represents a potential attack path for threat actors to discover and exploit. This has been exacerbated by the popularity of household IoT devices aimed at consumers. Combined with [remote working](https://www.financedigest.com/shoring-up-cyber-defences-in-the-remote-working-era.html "Shoring up cyber defences in the remote working era"), the line between personal and corporate networks is more blurred than ever. In many cases, threat actors can exploit the [vulnerabilities of an IoT device and laterally move across the network to compromise more valuable assets](https://www.financedigest.com/how-financial-services-organisations-can-address-the-vulnerability-lag-and-safeguard-their-most-important-digital-assets.html "How financial services organisations can address the ‘Vulnerability Lag’ and safeguard their most important digital assets"). This has become trivially easy for cyber criminals, with automated scans quickly identifying exposed devices connected to the Internet. From there, attackers will look for issues like unpatched vulnerabilities or weak [security policies that will let them jump into the main IT network](https://www.financedigest.com/new-demands-on-network-security.html "NEW DEMANDS ON NETWORK SECURITY"). Once this is achieved, they are free to start executing standard [attack tactics such as data exfiltration or ransomware](https://www.financedigest.com/preventing-an-operationally-crippling-ransomware-attack-do-you-know-where-your-risk-exposure-lies.html "PREVENTING AN OPERATIONALLY CRIPPLING RANSOMWARE ATTACK – DO YOU KNOW WHERE YOUR RISK EXPOSURE LIES?") deployment. Common issues like unpatched devises and unmonitored network traffic make it even easier for threat actors to find and exploit connected machines without being noticed. **IoT is often said to have put performance ahead of security. Is that still true?** IoT is a fairly new field to the IT world. [Vendors are still in the process of understanding the threat](https://www.financedigest.com/cup-holder-market-emerging-industries-challenges-and-threats-faced-by-key-vendors-and-global-business-outlook-till-2031.html "Cup Holder Market Emerging industries, Challenges and Threats Faced by Key Vendors and Global Business Outlook till 2031") landscape, and therefore often do not fully appreciate the potential risk of these devices, which results in security usually taking a backseat in IoT design. The general level of device security has [improved somewhat more recently](https://www.financedigest.com/leno-bags-market-witness-a-spike-in-growth-pace-recent-improvements-in-pricing-models-fmi.html "Leno Bags Market Witness a Spike in Growth Pace Recent Improvements in Pricing Models: FMI"), but it’s normal to find that products are still lagging behind more standard IT hardware. Common issues include lack of adequate [protection for network traffic and data](https://www.financedigest.com/4-steps-you-should-be-taking-to-protect-data.html "4 Steps You Should Be Taking To Protect Data"), and poor accessibility for users to manage critical areas like passwords and updates. The situation should [improve in the next few years thanks to new IoT security regulations](https://www.financedigest.com/german-regulator-calls-on-allianz-to-improve-controls-source.html "German regulator calls on Allianz to improve controls – source"). The US for example launched the [IoT Cybersecurity Improvement Act of 2020](https://www.congress.gov/bill/116th-congress/house-bill/1668), the UK and EU are among other markets working on laws. In the meantime however, organisations need to be cautious when selecting IoT devices and do their [due diligence](https://www.financedigest.com/why-due-diligence-is-so-important-for-direct-debit-customers.html "Why due diligence is so important for Direct Debit customers") in checking for security functionality and any known issues. **What can financial organisations do to manage IoT security?** Even the more secure IoT products represent a level of risk, and [firms will need](https://www.financedigest.com/europe-power-firms-need-1-5-trillion-euros-in-margin-calls-equinor-says.html "Europe power firms need 1.5 trillion euros in margin calls, Equinor says") to ensure these risks are balanced by the right security measures. But of course, this is true of most new business investments, and few [sectors are more adept at assessing risk than financial services](https://www.financedigest.com/boom-or-bust-how-the-financial-services-sector-is-coping.html " Boom or Bust: how the financial services sector is coping"). However, [balancing security](https://www.financedigest.com/balancing-innovation-and-security-within-the-financial-services-industry.html "Balancing innovation and security within the financial services industry") and performance can be a challenge. [Financial firms](https://www.financedigest.com/top-north-east-financial-adviser-firm-talks-corporation-tax.html "Top North East financial adviser firm talks corporation tax") cannot risk having something like an unsecured customer service terminal connected to their network, but complex or rigid security measures will also render the device ineffective and ultimately impact ROI. [Cost is also an important](https://www.financedigest.com/german-gas-import-costs-surge-153-in-first-half-as-imports-drop-24.html "German gas import costs surge 153% in first half as imports drop 24%") consideration, especially when a large number of devices are at play. If a company has hundreds of devices, managing each one manually becomes a colossal task. A new model known as [Secure Access Service](https://www.financedigest.com/facilitating-open-finance-through-secure-services.html "Facilitating open finance through secure services") Edge (SASE) provides an effective solution to these challenges. This approach converges multiple network management and [security functions into a single service that can be delivered entirely through the cloud](https://www.financedigest.com/cloud-security-and-the-department-of-go.html "Cloud security and the ‘department of go’"). SASE is designed to integrate security and network performance, making it easier to perform key functions like monitoring network traffic and [restricting access](https://www.financedigest.com/russia-blocks-facebook-accusing-it-of-restricting-access-to-russian-media.html "Russia blocks Facebook, accusing it of restricting access to Russian media") without impacting network speed. This combined approach also means that [data no longer needs to pass through multiple virtual](https://www.financedigest.com/what-is-a-virtual-data-room-unveil-the-essential-information-here.html "What is a Virtual Data Room? Unveil the Essential Information Here!") network functions (VNFs), helping to increase connectivity and reduce lag. SASE can also be used to deliver network segmentation, creating a barrier between network areas. With segmentation in place, even if an IoT device is compromised, attackers will be blocked from moving into the rest of the network. A cloud-based deployment also means that all devices on the network can receive the same level of security, covering even the largest IoT suites. [Financial firms still need to do their due diligence in selecting reliable products](https://www.financedigest.com/50-of-consumers-wont-spend-more-than-20-minutes-applying-for-financial-products-online.html "50% of consumers won’t spend more than 20 minutes applying for financial products online") and ensure they have followed best practice around password security and patching. Taking these steps will [drastically reduce](https://www.financedigest.com/white-bullets-piracy-demonetising-programmes-drastically-reduce-ad-revenues-to-piracy-websites-across-europe-analysis-finds.html "White Bullet’s piracy demonetising programmes drastically reduce ad revenues to piracy websites across Europe, analysis finds") the risk exposure created by new devices, while SASE provides a powerful second line of defence against any criminals seeking to exploit IoT in their attacks. --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---