Small and midsized businesses (SMBs) have some security work ahead as two major edge device vendors (Asus and Zyxel) announce critical security vulnerabilities to patch — and another (Western Digital) cuts off unpatched devices from the cloud.
Asus released new firmware on June 19 to fix nine separate vulnerabilities in several of the company’s router models, one of which could let a cyberattacker gain code execution ability. Two of the most serious flaws are a critical memory corruption weakness in the Asus router firmware, tracked under CVE-2022-26376, and the second could allow a threat actor to “achieve arbitrary code execution,” according to NIST, and dates back to 2018, tracked under CVE-2018-1160.
The same day, Western Digital announced it has blocked devices running unpatched firmware from its cloud as of June 15.
A severe vulnerability impacting Western Digital’s MyCloud Home and other cloud storage devices could lead to remote code execution, according to NIST. Despite the fact that the bug, tracked under CVE-2022-36327, received a CVSS vulnerability-severity score of 9.8 out of 10, the flaw was known to the public for a full month before affected devices were blocked from accessing the Western Digital cloud.
Also this week, Zyxel released patches against code-injection vulnerabilities in three versions of its network-attached storage devices. The firmware command injection vulnerability is tracked under CVE-2023-27992 and could let an unauthenticated user execute operating system commands.
SMB Edge Cyberattack Surface Explodes
This glut of edge-device patch warnings this week showcases the fact that SMBs are increasingly at risk thanks to the exploding number of edge devices being connected to their networks. For an idea of the scale of the endpoint attack surface, experts put the number of active Internet of things (IoT) and edge devices around the world at more than 12 billion. That number is expected to hit 27 billion by 2025.
At the same time, many of these organizations are largely woefully lacking in basic cybersecurity hygiene and monitoring. At first, edge devices can seem like an economic choice for building out an SMB infrastructure, but they are much tougher to secure, explains Melissa Bischoping, director, endpoint security research at Tanium.
“For small businesses, using small-office-home-office (SOHO) routers and devices is often a cost-effective solution,” she says, “but the lack of monitoring and centralized management in many of these devices can result in vulnerabilities and insecure configurations that provide easy access to an adversary.”
Meanwhile, never ones to miss an opportunity, threat actors are making the most of this sweet spot.
“Edge infrastructure is an incredibly attractive target for attackers because it generally lacks the depth of monitoring and visibility that endpoints have, and is always public facing by design, removing an initial hurdle for access,” Bischoping explains.
Making these devices an even softer mark, many are built with open source components, says John Gallagher, vice president of Viakoo Labs.
“Edge devices like routers, NAS drives, IP cameras, and other IoT/OT systems are the fastest growing part of an organization’s attack surface due to their use of open source software components and often being unmanaged and unmonitored,” Gallagher explains. “Traditional IT security solutions that are agent-based don’t work for IoT/OT devices which require agentless solutions.”
How SMBs Can Secure the Edge
Securing the SMB edge starts with knowing what there is to protect, according to Gallagher.
“First, make sure you have a complete inventory of devices by using an agentless asset discovery solution,” Gallagher says.
Once cybersecurity teams have visibility into what there is to defend, that information can be used to direct resources effectively, Bischoping adds.
“Prioritize visibility of the edge assets and leverage that information to address patching, credential management, and configuration hardening as part of your ongoing security hygiene and controls,” she says. “Other quick wins include ensuring you’ve rotated default login credentials on these devices, employed secure authentication mechanisms, and enforced least-privilege access for any accounts that may log in to those devices.”
And, to handle with firmware and password updates at the scale required for IoT and edge devices, Gallagher recommends an automated approach.
Commenting on how SMBs can manage the edge more effectively, organizations should also consider whether devices need to be connected to the Internet, or would be better suited for a more secure internal network connection, advises Matthew Morin, senior director of product management with NetRise.
“In the case of many vulnerabilities announced by Asus, Zyxel, and Western Digital, ensuring the affected devices were only accessible via internal networks would have dramatically reduced the impact of the vulnerabilities,” Morin recommends. “SMBs must understand what is publicly disclosed from their networks and regularly review if what is exposed needs to be there.”
Teams should also look for devices with no particular owner or purpose and pull the plug. “Lastly, ensure that devices have clear ownership and tracking of their lifecycle management, so that devices that go end of life or end of support can be replaced before they get exploited.” Gallagher adds.
Once those processes are in place, Morin says the next step for more mature organizations is incorporating software bills of materials (SBOMs) for added visibility.
“For more mature organizations, a good next step is ensuring that they have component-level visibility, such as an SBOM for network-connected devices,” Morin adds. “In this case, with an SBOM, an organization could have been aware of this risk well before the vendor decided to patch the issue.”
