The Internet of Things
Technology is making life easier for all of us every day, and chances are, you are already utilizing products that are considered IoT devices. IoT or the Internet of Things, refers to the collection of devices connected and controlled over the Internet.
"Alexa, turn the air down to 72 degrees"
"Hey Google, add milk to my shopping list"
"Hey Siri, play classical music"
...all will become more familiar everyday commands as more households and businesses alike embrace IoT. Recent estimates project the number of Internet connected devices to reach 38 billion by 2020, with some studies suggesting an even higher adoption.
It is exciting to experience these innovative products but there is always the need to be aware of the security risks associated with any internet-connected device.
What are some items that make up the Internet of Things?
IoT products are often referred to as "smart" and include mobile phones, cars, refrigerators, coffee makers, televisions, microwave ovens, fitness bands, thermostats, smartwatches, webcams, light switches, door locks, door bells, copy machines, digital assistants and medical devices; almost anything that has an on/off switch and connects to the Internet directly or to is controlled by Internet connected devices.
What are the security risks and concerns of using IoT products?
Many popular IoT products, are manufactured with a goal of convenience for the user through the integration of devices and systems, but not always with security top of mind.
Tracking Your Activity
With your smartphone's range of sensors such as GPS, and connectivity options (Cell, Wi-Fi and Bluetooth), your device can potentially monitor your movements and location, throughout the day. Smart assistants have access to your calendar, contacts, purchase history and more to make your life more convenient.
Tracking Your Home
IoT devices such as Smart Thermostats use sensors, real-time weather forecasts, and occupancy detectors to monitor actual activity in your home. As the smart assistants become "smarter" they record requests to improve responses.
Privacy
IoT devices often sense and collect consumer and personal information and share this with other IoT devices. Have you ever had that feeling you were being followed when you received a notification for a product or service that you had not expressed interest in but it seemed to align with your personal preferences? This may be a sign of IoT sharing.
Not Engineered with Security in Mind
Many manufacturers are designing their products with rigorous security standards. Unfortunately, there are others introducing low-cost, quick-to-market IoT-enabled devices with little to no embedded security defense mechanisms, placing your privacy at risk.
How can you protect yourself in this brave new world of the Internet of Things?
Here are some suggestions:
- Do not store personal identifying information on any device.
- Ensure your home network only allows access to authorized users. If devices are password-protected, switch to a two-step authentication process and create complex passwords (password123 will not work!). For instance, develop a password with a combination of lower and upper case letters, numbers and symbols or a passphrase, movie or song that you can remember easily but that has been adapted to make it difficult to decipher. For example, "The Wizard of Oz" could be re-configured into the password, Th3WZRD!ov0Z. Be sure to use unique complex passwords on each of your devices and change them every other month. Or if your home network is capable of creating a secure "Guest" wireless network, attach IoT devices to the Guest wireless instead.
- Most hacks occur via Wi-Fi or wireless networking, and unsecured Wi-Fi systems are among the easiest to access. The first line of defense against unauthorized access is to make it difficult to gain entry to your network. Again, good password hygiene is imperative.
- IoT products from a reputable manufacturer. Thoroughly research any IoT devices you are planning to purchase to determine if the manufacturer conducted comprehensive security testing. Publications such as Consumer Reports often provide detailed reviews of these types of products.
- As a consumer, make a point to conduct research and review user agreements (and other fine print), and consent to IoT updates or purchases only when you feel confident in their security. Find out what information is gathered and stored by your device as well as how the manufacturer uses the information. Privacy principles dictate that users should be able to keep control of their data as well as to be able to opt out of the "smart" environment without incurring negative consequences.
- Your smartphone is often the device used to manage other IoT devices, opening up an avenue for hackers to gain entrance to your home. Keep your smartphone protected with a strong and unique password that is separate from your internet passwords. Also, install smartphone software updates when they become available.
- Use and update anti-virus and anti-malware software on all of your Internet connected devices.
The Internet of Things will never be completely safe; but neither is the world outside of the Internet. Just as you take proper precautions to ensure your house is entirely secure against theft, employ the same types of best practices to defend against a potential data breach.