alt Hacker NewsAre these IoT devices actually directly on the internet, in the sense of exposing a port on a public IP address (perhaps behind NAT)?
Because you'd think it would work to just have them on a VPN, and then they aren't responsive to any non-authenticated internet traffic?
I imagine that, unfortunately, a lot are, but others might lack things like MFA at their trust boundaries
IT security is a pretty complex topic and a lot of businesses don't have the knowledge in-house to access the security of their own infrastructure
If you have no-one to actually patch your devices and architect your infrastructure, you'll probably end up with just asking the "geeky" student assistant to get it sorted. They'll throw it on the office WiFi, set the same user+password on all the devices and call it a day
In my experience, the vast majority of orgs have essentially no IT security