Companies have relied heavily on creating dynamic spaces within their offices that cater to employee amenities. This includes environments like gyms, wellness centers, lounges, breakrooms, cafeterias, and huddle spaces. While these amenities benefit corporations by helping them attract top talent and retain employees in the office for longer hours, they also introduce a vast amount of unmanaged “smart” and IoT devices into the building.
Certain devices, such as digital soda dispensers, utilize an out of band cellular connection running on lightweight Linux architecture to communicate with vendors regarding supply levels and maintenance. At first glance, this architecture seems secure because it creates a perceived air gap that implies total isolation from the internal corporate network. However, many buildings suffer from poor cellular reception, forcing these machines to rely on a fallback connection to the corporate guest Wi Fi. If this guest network is misconfigured, the machine immediately becomes a viable, exposed attack surface.
Furthermore, because these machines are maintained by outside vendors, they introduce critical physical security risks, such as a field technician plugging the machine into an available wall port that has been left active with internal network access. Compounding this issue, internal security teams have zero visibility into the device. They cannot audit when these machines are updated, what password policies are enforced, or access the machine’s local logs.
To mitigate these supply chain vulnerabilities, internal compliance teams must work closely with third party vendors to formally assess risk. Concurrently, security teams must ensure that all physical ports in public amenity areas remain disabled by default, and that guest wireless networks are strictly isolated and monitored.