IoT Traffic Surges 150‑Fold in 2019, Yet Security Gaps Persist

In May 2019, our research team monitored 56 million IoT transactions across more than 1,000 organizations, representing 270 distinct device types.

That volume is over 150 times higher than the traffic we measured in 2016, underscoring the rapid expansion of IoT deployments in enterprise environments.

Connecting a device to a network is almost effortless, yet identifying and managing those devices remains a critical blind spot. Without comprehensive visibility, organizations cannot verify that device communications are secure.

Our data revealed traffic from consumer‑grade devices—smart watches, home assistants, even connected cars—known for weak security. Many ship with default passwords that are rarely changed, making them prime targets for brute‑force attacks. In fact, recent IoT malware samples contain hard‑coded default credentials, turning the attack vector into a trivial task.

It is alarming that, in 2019, manufacturers continue to release products with minimal security controls. The prevailing assumption that “no data is stored on the device” led to a dismissal of intrusion prevention. The Mirai botnet attack proved that this mindset is dangerously flawed, as compromised devices can be mobilized en masse to launch distributed denial‑of‑service and other attacks.

More than 90 % of the IoT traffic we analyzed used plain‑text HTTP, exposing data to interception and man‑in‑the‑middle manipulation. In contrast, encrypted SSL/TLS traffic now represents 94 % of global Internet traffic, highlighting the necessity of encryption for IoT as well.

We identified six distinct malware families targeting IoT devices, including a Mirai variant. On average, we blocked roughly 6,000 IoT‑based malicious transactions each month. Several of these exploits dropped payloads that leveraged vulnerabilities in IoT management frameworks, enabling remote code execution and transforming the device into a bot.

Until manufacturers adopt a security‑by‑design approach, IoT devices will remain an attractive target for adversaries. Download our full May 2019 analysis for a deeper dive.

– Deepen Desai, Vice President of Security Research at Zscaler and Director of ThreatLabZ.

>> This article was originally published on EE Times: “IoT Security Gap Is Widening.”