IoT Security & Privacy: Reducing Vulnerabilities

In a recent 2015 cybersecurity report, AT&T charted a 458% increase in Internet of Things (IoT) vulnerability scans of devices. This is  just the latest indication that hyper-growth of IoT devices, sensors and systems across business, consumer and government sectors puts users' information privacy and security at risk.

The Internet of Things (IoT) universe of devices, sensors, networks and technologies is so vast that meaningfully addressing any aspect of it -- such as security and privacy -- can be daunting. Even narrowing the scope down to specific IoT use cases, such as vehicles/robots, smart homes, critical infrastructure, connected medical devices, wearables, or HVAC systems, requires factoring in numerous and complex security considerations.

That said, market growth projections make it clear that the stakes are too high and business opportunity too great for vendors to shy away from efforts to improve IoT security and privacy. In this post, I'll examine the current state of IoT security and privacy, and what needs to be done to preserve the privacy and security of information that travels across connected networks.

Insecure legacy

Growing adoption of IoT requires overcoming a legacy of insecurity. This is not unique to the Internet of Things: Too often, software and products today are built to work as intended, and then after the product is out on the market cybersecurity is factored into the equation. More specifically, this process occurs in the following stages:

For some context, email is in stage 8. It originally had no security, but senders and recipients trusted one another. Then spam happened and everyone recognized the need to address security and privacy issues. IoT is currently somewhere between stages three and four. It isn’t yet ubiquitous, but many people believe it’s poised to get huge, and if it becomes a stage eight technology without security and privacy addressed on the front end, it's a recipe for disaster.

IoT security & passwords

A number of IoT devices available today have defaulted to the lowest hanging fruit for security and authentication: passwords. Passwords are bad for the web; for IoT, they’re a disaster for a number of reasons. First, IoT devices are almost always very limited in their user interface -- they don’t have keyboards to type a password into, nor do they have screens on which to display random “pairing codes."  When you try to bolt a “password-like” system onto something with a difficult interface, you usually end up with something weak.

For example, I have an Internet-connected music player at home where I have to key in my router password with the tuning knob. Similar things happen with TV systems. Your router password needs to be strong, but these systems make it super hard to key it in. A password that’s hard to type means that it will be very short and hackable, while a PIN code, usually only four characters, is even worse as any computer can brute-force 10,000 combinations in a matter of seconds.

As a result, most devices mix up the concept of its user’s identity (and which user in the household is the user) and its own identity (the device proving itself to a remote network). We can barely fix the federated identity problem on the Internet, let alone the new problem of low-power, low-UI devices.

Passwords endure as a frustratingly popular yet weak security link, one that is terribly inadequate for IoT and should challenge vendors to embrace more secure authentication methods throughout the development process.

Developing a different approach

Vendors must adapt a different approach for IoT than was done with the Internet, which was “you are the product, not the customer.” Sticking with this old approach would treat IoT user privacy as second fiddle. Getting privacy right is even more important with IoT than it is with computers because IoT extends beyond a smartphone or laptop screen to end user applications such as Internet-connected baby monitor video cameras, door locks that can be opened remotely with an app, wearables that track our movement and smartphones that track our location.

The physical nature of IoT has an enormous potential impact on privacy because it involves going beyond “what you do on your computer” to “what you do anytime, anywhere.” As referenced at the outset, wrapping our arms around security and privacy across the entire IoT system is a daunting task. Nonetheless, a vendor and industry approach should consider the following layers:

Emerging IoT solutions for security and privacy are promising. These include making users' mobile phones their security and privacy “key” that can confirm device pairing, leveraging cryptography instead of a keyboard and passwords, and privacy-preserving personal data storage systems so users control their  private data shared across IoT systems. IoT can be made secure and user privacy can be preserved if vendors, government and enterprises build security into the IoT from the beginning.