Connected businesses are becoming increasingly vulnerable to cyberattacks: how to protect data and business operations
The widespread adoption of Internet of Things technologies in businesses brings benefits but also significant vulnerabilities
In just a few years, Internet of Things (IoT) technologies have revolutionised the way businesses operate, making it possible to control cameras, fridges, air-conditioning systems, industrial machinery and many other devices remotely, with enormous benefits in terms of efficiency, automation and cost reduction. The race towards an increasingly interconnected world has taken on staggering proportions, and in Italia alone there are around 175 million connected devices, although these are often installed without taking into account that every device connected to the network can become a gateway for cybercriminals, risking not only the confidentiality and security of data, but also business continuity and the operations of companies.
When innovation becomes a vulnerability
The fact that no organisation is immune to such risks is demonstrated by the State of IoT 2026 report, published in September by Eseye based on a survey of 1,200 IoT strategy managers, which found that 73.3 per cent of the companies surveyed had suffered at least one security breach linked to connected devices in the last twelve months. This figure is even more worrying when one considers that 78% of companies still plan to increase the number of connected devices over the next eighteen months, viewing IoT connectivity as a management priority. This paints a picture of businesses that are increasingly reliant on internet-connected technological infrastructure, which can undoubtedly improve process efficiency, but the management of which also entails significant challenges, with additional requirements in terms of governance, maintenance, cybersecurity and business continuity.
Managing security even before you buy
Although there is never such a thing as ‘zero risk’ when it comes to cyber attacks, organisations can still adopt an effective approach to information security and confidentiality by referring to internationally recognised standards such as those set out in ISO/IEC 27400:2022, “Cybersecurity — IoT security and privacy — Guidelines”, which provides guidance on the risks, principles and controls to be considered when protecting IoT ecosystems.
One of the recommended measures for reducing the risks associated with the Internet of Things relates to purchasing decisions. Before introducing a connected device, a company should assess not only its price and performance, but also the manufacturer’s reliability, security guarantees and the duration of support. A piece of machinery may be designed to function perfectly for many years, but it could become vulnerable sooner than expected if the supplier were to stop providing updates. It is therefore important to include specific commitments in contracts regarding maintenance, incident management, and the ability to continue using the equipment even when external services are no longer available.
Another priority is to draw up a comprehensive and up-to-date inventory of IoT devices in order to know exactly which devices are connected to the company’s networks. Cameras, sensors, air-conditioning systems and smart machinery should be inventoried, identifying those most critical to business continuity, and properly decommissioned when they are no longer in use. It is, in fact, not uncommon for equipment purchased by individual business units to slip through the net of IT managers, becoming potential entry points for criminals. It is also essential to prevent a secondary device from compromising more critical systems: for example, a camera or a thermostat should not be able to communicate with databases containing confidential data. Access for suppliers and external maintenance staff must also be restricted to what is strictly necessary for operational purposes.
