Published June 17, 2022
Effective IoT security requires collaboration and clarity
When firefighters arrive at burning buildings, they must contain the blaze, rescue inhabitants and keep calm under pressure. As IoT devices are increasingly deployed throughout cities, firefighters could have access to more information that could save more lives and lead to less lost property through use of real-time data about surroundings impacting people in need.
In an emergency where IoT devices are available, responders can use the data collected to have a more efficient and often more successful response. Responders can learn about the occupancy of a building via occupancy sensors, surrounding infrastructure from utility and traffic light sensors, and the status of victims’ health vitals through activity wearables. These previously unavailable real-time insights can help responders better prepare for situations and save more lives.
Life-saving applications such as these can transform how disasters are handled, especially if they are deployed at a large scale, but public safety protection should not come at the expense of compromised security and privacy for businesses, government agencies and citizens.
IoT devices are being deployed at an exponential rate, with 27 billion IoT connections expected by 2025. However, IoT security has not kept up with the torrential pace of innovation. As IoT devices with life-easing and potentially life-saving benefits see more use, the scale at which drastic cybersecurity attacks occur also grows.
To get ahead of security breaches, companies manufacturing these devices have a responsibility to rapidly address the vulnerabilities in their products. The risks of widespread IoT adoption should not outweigh the societal benefits.
Hackers have easy access
When implementing new smart devices into cities and homes, there is often an assumption that those devices have at least a base level of cybersecurity. While industry alliances and government agencies have published various guidelines and cybersecurity standards establishing minimum-level security, many IoT device makers and vendors have not adopted or implemented any of them.
Numerous devices that were previously isolated — such as refrigerators, gas meters, cars and medical devices — are now connected but often without rigorous consideration of security frameworks. These devices were never intended to interact with remote, unauthorized users, so access controls and proper credentials management might be weak or nonexistent. Hackers can exploit these simple security vulnerabilities without much effort. It is simple to access, and doing so violates the confidentiality and integrity of private user data and affects device availability.
For example, firefighters can use IoT devices and sensors to gain data about a building’s status and inhabitants, but if devices were hacked, the gathered data could be inaccurate or potentially misleading. Firefighters could spend valuable time and energy to locate a person, with incorrect data pointing them to the wrong area. The devices designed to be helpful could become a detriment and hinder the firefighters’ efforts to rescue building residents.
Attacks on IoT device security can occur at all stages of production — from the specification and design stage; to fabrication, packaging and testing; to the distribution and integration of end-user products. Chip manufacturers, device manufacturers and consumers each play an important role in IoT device security.
Many of the security shortcomings devices have are the result of unclear guidelines about who is responsible for security decisions. During IoT device development, one company may design the device, while another company provides software, operates the network that supports the device and deploys the device.
The confusion has led to inaction by all parties, especially because there is insufficient incentive to adequately secure products. It is important that industry leaders adopt IoT security standards and work together to address essential areas of improvement.
For many years, the IoT industry has been largely unenthusiastic to self-regulate, and as a result, there are now federal and state policies being introduced to guide security regulation in the industry, including the following:
- IoT devices must only run authenticated code.
- Use only secure interfaces for debugging and communication.
- Secure, remote software update capability is mandatory.
- All devices must have a unique identifier.
- Incorporate a vulnerability disclosure program and product incident response.
These requirements only cover basic needs, but they require device makers and application developers to radically increase the level of security in product development.
Consumers also must maintain their devices and enable devices to update while in use. They should also be vigilant about phishing and social engineering attempts for hacking.
In the U.S., new policy will require a baseline of cybersecurity protections in devices sold within the country. In May 2021, President Joe Biden issued the “Executive Order on Improving the Nation’s Cybersecurity,” which calls on agencies to enhance cybersecurity guidelines throughout the software and hardware supply chain.
Manufacturers can now to begin to implement security standards and work with others to create a universal industry standard — before legislation dictates all requirements. NIST is working with the IoT industry to design, standardize, test and foster the adoption of general methods to protect IoT devices from cybersecurity breaches.
The Department of Homeland Security (DHS) is using NIST’s work to create best practices and requirements for all devices sold within the U.S. DHS can only drive private sector industry action up to a certain point, and it is important that industry leaders work together to create and adopt standards for devices sold in the country.
This article originally appeared on techtarget.com, to read the full article, click here.
