Security and the Internet of Things

by William V. Burns

October 22, 2014

What is the Internet of Things?

The Internet is a network – a group of objects connected by an electronic medium. The Internet you are familiar with consists of clients, such as PCs, laptops, tablets and smartphones, that connect through cable modems, phone modems, wireless access points, or cellphone towers to a massive maze of switches, routers, backbones, and servers.

As mysterious and unknowable the Internet of today is to the average consumer, the upcoming Internet of Things will be much less familiar, and more pervasive.

…sensors and actuators embedded in physical objects—from roadways to pacemakers—are linked through wired and wireless networks… (McKinsey Quarterly – The Internet of Things)

The idea is for each important device and object to have its own presence on the Internet. Imagine your toaster, your refrigerator, your home security system, your car, your children’s toys, the doorknob on your front door, light bulbs… An endless list of network-enabled household items will be gradually purchased, installed.

How big is this going to get?

About 50 billion machines and devices could be linked by 2020 — Cisco Systems

IDC said the installed base of things connected will be 212 billion by the end of 2020, including 30.1 billion connected autonomous things — ZDNet

Estimates are disputed, but with all sorts of networking and Internet capabilities being built into consumer devices, including wearable connected devices, you can be sure that market penetration will be wide.

Is there a security threat to you, the consumer? Yes, but you can work to reduce the threat.

My fridge has been hacked?

Already in the emergent Internet of Things there have been scattered security breaches and attacks using the new infrastructure. The most infamous so far was recounted at Proofpoint:

The global attack campaign involved more than 750,000 malicious email communications coming from more than 100,000 everyday consumer gadgets such as home-networking routers, connected multi-media centers, televisions and at least one refrigerator that had been compromised and used as a platform to launch attacks.

There have been securirty camera hacks, baby monitors taken over, and social media accounts compromised. Mobile phones and other devices have been broken into and the photos stored on servers copied.

Hacking is the flashiest sort of attack, but a more likely assault on your own ‘things’ will be data theft, personal and financial information silently copied from network-attached devices you update yourself, or that your corporate ‘partners’ such as online merchants, banks, and even governments enhance with your data.

Some Fitbit users in the past have found statistics about their sexual activity posted online —Forbes

When are you away from home? Your security system knows. What is your medical history? Your smartphone fitness app knows. What medicines do you take? Your pill reminder knows. What do you buy? Amazon, and stuff you link it to, know. Who is your spouse? Who are you cheating on them with? Your personal calendar app knows. Who do you meet with? Where do you work? What is your bank account balance? What is your credit score? It’s all available, for good, or ill, in the Internet of Things.

Securing your ‘Internet of Things’

1) Find out what you have, be aware of what you buy, or your landlord installs.

Any powered-on item in your home, from power strips, light bulbs, thermostats, appliances, set-top boxes for cable, and personal items you connect to the Internet could potentially fall into this category.

Make an inventory.

• If it’s older than 2012, and not wired to the Internet, or periodically dumped to your PC, leave it off the inventory.
• If it is connected to the Internet and is not a PC of some sort, put it on the inventory.
• If it is a ‘smart appliance’ – check the manual and specs to see if it is connected.
• You need manufacturer, model name, date of manufacture, serial number.
• Check on the Internet for technical specifications to see if the device is Internet-capable and what it does besides its major consumer duties. Your big screen TV might have a RJ-45 cable jack in the back, but if it’s not wireless, it’s not connected to the Internet.
• Update the list of online devices whenever you buy or acquire something. Don’t forget gifts. That new BluRay player…
• If you have a smartphone, you can download a network discovery app, change your connection on the phone to your wireless network, and then scan your network for connected devices. I use Fing.

2) Read the privacy agreement if they exist for these devices. You may find some surprising sharing of data with company ‘partners.’

3) Physically secure the devices. Get rid of any you don’t want or need. Make sure your hand-held and pocket and purse-held devices are password protected. If you can activate services where you can remotely disable them in the event of a theft, do so.

4) Register your purchases online to receive updates such as recalls or notices your data may have been compromised.

5) Situational awareness is key. Watch news and social media sources for information about current security vulnerabilities, hacks, and misuse of information. Don’t be an early adopter of new, untested technology or buy the latest shiny new gadget unless you’re technically adept enough to understand all its potential security issues.

6) Don’t volunteer or store potentially embarrassing or sensitive data on devices that connect to the Internet, if possible. Nude selfies, exercise information that includes frequency of sexual activities, banking info, passwords, pay level and retirement plans, etc.

7) Update your devices – security patches, anti-malware software, firmware updates – these are where your manufacturer fixes security issues as they find them.

The Internet of Things will bring many benefits: greater social interaction, better home security, easier access to medical and financial resources, and an interconnection that will enable social changes we cannot even forecast. With some precautions by the consumer, and increased security measures (already underway) by the manufacturers, this can be a positive development.

---

 

Bibliography:

 WhatIs.Com — Internet of Things (IoT)

 Forbes — World’s Top Privacy Experts Worry about Internet of Things

 Austin Business Journal — Behmann: How the Internet of Things promotes collaborative innovation

 TechCrunch — Convergence In The Internet Of Things Is Priming The Tech World For A Major Cultural Shift

 Cisco — Internet of Things (IoT)

 The Internet of Things Council — What is the Internet of Things?

 InfoWorld — What the Internet of Things really means

TechoPedia — Internet of Things (IoT)

 McKinsey Quarterly —The Internet of Things

room5 – IoT Expertise

 Forbes – Security and the Internet of Things

eSecurity Planet – The Internet of Things is a potential security disaster

ComputerWeekly – The Internet of Things is set to change security priorities

 Proofpoint – Proofpoint Uncovers Internet of Things (IoT) Cyberattack

 ZDNet – Internet of things: $8.9 trillion market in 2020, 212 billion connected things

 BusinessWire – The Internet of Things Is Poised to Change Everything, says IDC