The scale of October’s Ddos attack on internet infrastructure provider Dyn came as a nasty wake up call to some in the tech industry, hitting seven out of ten of the world’s most visited sites, from Spotify and Twitter to the New York Times. Not everyone was so surprised, however – cyber security experts have been warning of the risks posed by the rapidly expanding internet of things for the last couple of years. According to them, it was really only a matter of time before assailants used hacked devices to launch a sizeable attack. 

So what are the main lessons tech professionals should learn from the incident? We’ve listed the key take aways:

Cover the basics

One of the most frustrating aspects of the attack, especially to anyone with an ounce of knowledge about internet security, was its utter lack of sophistication. This was no refined network breach, simply a large number of undersecured devices that were easy for the (as yet unidentified) hijackers to bombard with increased traffic. We may think we’re being ultra-edgy by hooking up our ‘smart’ baby monitors or refrigerators to the internet, but if you fail to protect them using basic measures such as replacing default passwords when you buy a new item or regularly updating firmware on your router, you’re leaving the door wide open to crooks. 

Questions of regulation

Calls have increased for governments to bring in specific IoT security regulation as a result of the mammoth breach. Just as the finance industry eventually had to be regulated after years of web-based fraudulent activity, so the US National Telecommunications and Information Administration (NFTA) are seriously considering what standards and protocols they could implement to stop similar or worse attacks. Businesses can start by implementing their own best practice codes, starting with configuring their networks to do decent ingress filtering.

Not Just the IoT

Although it’s the internet of things that’s shown itself to be too susceptible to attack this time, there’s still a substantial proportion of websites out there with security that’s just as flawed. Many badly secured or under-patched sites that act as malware distribution servers for attacks on PCs are otherwise completely legitimate, meaning blame is often difficult to pin down and they can often be used by attackers repeatedly because simply removing the malware isn’t enough. Follow advice from security experts around decent firewalls, using tools such as Nmap to scan for holes and regular patching, to ensure your home and business are adequately protected.