With the evolvement of internet of things (iOT), our daily items such as internet enabled devices, equipment and home appliances suddenly become candidates for exploitation if they are properly configured.
Most of us will think that this will not happen to us. In actual fact, it can happen to any of us. We may not understand the risk that is involved, therefore emphasised will not be placed in this area.
Nowadays, most homes will have routers and network attached storage (a storage system to a layman connected by network cable). When we buy it, we just add on to our existing network and use it. We are more concern about functionality. Happily, we just add loads of information to the NAS. Photos, scanned documents, contacts, sync data of mobile devices and so on.
As time passed, our NAS will contain pool of useful and important information. What if, one day when we went home and we discovered that our files in the NAS is missing or files are encrypted and so on. Would we then pay attention to the security aspect of the NAS or in totality are home network?
Yes! That is the time where eveything start to make sense especially the security aspects of the entire IT system at home. When we lose our control over the things we own dearly, we will start to place emphasis on IT security in the home.
It happens to me too! When I run ftp (file transfer protocol) command to my NAS as a guest two days ago, to my horror, all my files are exposed without the need to issue any password. I have missed that out during the initial configuration of the NAS. I was simply to eager to get it to work that I missed the security aspects of it totally.
This is one example which actually shows that if someone can access into our network, all the files on my NAS would have been compromised. Imagine that if we had stored our personal information Depending on the type of router that you have, you will need to disable or configure the ftp service on the NAS.
Most NAS will allow you to store your files on them. However, getting the right NAS in today's context it is not about functionality alone anymore. In addition, it is important to get your NAS from a reputable source to ensure the device is safe and not easily susceptible to hacking. This is because in this way, we will know that the device we use is safe and robust.
Other aspects of security is also how the NAS should be connected to the router in your home. This is because connection to the NAS should be separated from other devices which has more risks of being "unsafe" example the unknown brand entertainment box (internet enabled).
I got one such box and when I installed Malwarebytes on it, it detected multiple malware. The apps which were detected were those apps that allow us to view movies. I was quite surprise and I made a decision to remove such apps from the box and use the box only for YouTube.
Getting the hardware and connect to our network is the easiest thing, however, ensuring that any new hardware to be added to existing network is a challenge as sometimes we may unknowingly allow malware into our home network.
Besides the NAS, the router we choose to deploy into our home network is also equally important. This is because a good router can last more number of years compared to a cheaper one in terms of performance and security wise.
Router like the ASUS RT-AC88U is a great router which I have acquired recently. It monitors the websites which the connecting devices visited and prevent the user from accessing the malware infected unsafe website. I sort of like this feature as it provides a economical way of protecting our computer system in the network something like a firewall.
Moving forward, I foresee our home will need a more secure network, one which we can reliably transmit important personal data within our home. To do so, we will need to take into consideration the design of the network and also the software configuration of the devices in order to harden them so that they will not be so easily susceptible to attacks.
About the Author
SHB had been working in the IT area for 20 years. He is specialised in software development and IT management system. He is CISA certified, lead auditor trained in ISO 9001 and ISO 27001 management system.
Main initiatives include IT implementations through framework such as ISO 27001, Business Continuity Management and best practices from the industries.
Enhance the security system in the organisation by looking into the network design and software configuration of the hardware providing awareness training to end users and IT staff.
Worked in the area of software design & development and IT security.