©2017 ARBOR® CONFIDENTIAL & PROPRIETARY

Devices Without Identity:

Internet of Things (IoT) in

the Enterprise Network

Arabella Hallawell
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 2

The Defender’s Reality in 2017

60% of enterprises take longer 

than 3 days to investigate a 

critical security event.

60%

The average dwell time (mean 

time to detect) a breach to the 

business.

140++

44% of advanced attacks in 2016 used 

social engineering or IT applications, 

NOT malware as entry points. 

44%

The mean time for initial 

compromise of a network.

9 Min.
©2017 ARBOR

® CONFIDENTIAL & PROPRIETARY

3

What We See Today...

• An unprotected IoT device 

on the Internet will get 

infected within 1 minute.

• An IoT device located 

behind a NAT device or a 

Firewall is not accessible 

from the Internet and we 

believe is (mostly) secure. 

But this is not always the 

reality...
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 4

The Weakest Link IoT:

Devices Without Identities 

NAC Struggles to Control 

Consumer Grade Devices

on Enterprise Network

Greater Attack Surface

Traditional Security Models Don’t 

Apply 
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 5

The Defender’s Reality with IoT in 2017

Back doors for automated Physical damage

Botnet / DDoS.

Use Malware as way to infect 

entire network (Windows Mirai)

The mean time for initial 

compromise of a IoT device.

<3 Min.
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 6

Implications & Potential Consequences

• The Zombie horde

A single infected Windows computer has now the 

capability to infect and subvert the ”innocent” IoT 

population into zombies, all under the control of 

the attacker.

• The attackers weapon arsenal

The attacker can now use the zombies to:

1. Infect other IoT devices.

2. Launch outbound attacks against external 

targets.

3. Perform reconnaissance on internal networks, 

followed by targeted attacks against internal 

targets.
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 7

Launching Outbound DDoS Attacks

• Attack activity generates a lot of traffic. 

Mirai can for example launch:

• UDP / ICMP / TCP packet flooding

• Reflection attacks using UDP packets

with spoofed source IP addresses

• Application level attacks (HTTP / SIP 

attacks).

• Pseudo random DNS label prefix 

attacks against DNS servers. 

• This attack traffic will quickly fill up any 

internal WAN links and will also will 

cause havoc with any stateful device

on the path, including NGFWs.
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 8

IoT: Enterprise Security Architecture Revisit

Enterprise

Users

Data Center

The Internet

DMZ

IDs

NG Firewall

Enterprise 

Core

IoT

Devices

Public Cloud

MSSP

Private

Cloud

SD-WAN 

Branch

Office

Internal 

Network

Scanning 
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 9

Defending Against IoT InternalThreats

• Implementing Network segmentation and harden (or 

isolate) vulnerable network devices and services.

• Utilizing flow telemetry to analyze external and 

internal traffic. This is necessary for attack

detection, classification

and trace back.

• Deploying multi-layered DDoS protection.

• Scanning for misconfigured and abusable services.

• Implementing Anti-Spoofing mechanisms on all 

edge devices.
©2017 ARBOR® CONFIDENTIAL & PROPRIETARY

Q&A / THANK YOU

10

Contact Information:

Arabella Hallawell, (Job Title here xxxxxxxxxxx)

ahallawell@arbor.net