Now I'm an optimist in general, so in my book that's an article worth reading. However I'm left unconvinced. It is too late. At least for the traditional approach advocated in the article. It's not that it's bad advice - it's great advice. It's just not going to work in the embedded environment with ever more capable devices.
Yes, shoddy IoT devices will be created, with shoddy implementations and poor security. This can and should be addressed along the lines advocated in this excellent article. The real issue though is not the stuff that's being sold now; it's when today's product, after moderate adoption, becomes tomorrow's "abandonware".
It's when today's product, after moderate adoption, becomes tomorrow's " abandonware".
The device creators move on, the players change strategy, new product lines come out; and the manufacturers cut their losses. I've seen it in several generations of network media players and mobile phones (early tasters of the IoT). TVs are likely to be the next following this arc to dangerous obsolescence - their life will be prolonged by the likes of FireTV or Chromecast. And they will continue running their built in Smart TV software as ghost ships, or once compromised - trojan horses, in our homes behind the firewall.
So how can the problem be tackled?
As a designer you must defend your IoT devices from other rogue devices within your home network perimeter:
Don't trust the local network and devices on it.
If possible build on a platform that will provide ongoing operating system updates directly from the OS vendor.
If running on a resource constrained platform like Arduino life is a bit trickier...watch out for a follow on post on this topic.
As a consumer:
Be wary of exposing sensitive systems to the internet. Look for a security whitepaper or evidence of security testing from the vendor.
Disconnect and dispose of legacy technology and set-top-boxes.
If you use a TV stick or set top box I would suggest disabling the wifi for the TV's native "smart" apps - especially if no longer supported and therefore no longer updated by the manufacturer - this should make the life of an attacker that bit harder.
IoT and home automation have the potential to revolutionise our lives, health, and work. However they come with risks - increasing our personal attack surface and the potential impact of security compromises. Many existing systems, open source, and closed, have been plagued with insecure implementations. This has resulted in consequences ranging from web cam spying, to unlocking garage doors, and even taking control of cars. A healthy level of caution should be applied, and potential impact of security failures carefully considered. Ask yourself, "what's the worst that could happen?", as part of your buying decision.
Ask yourself, "what's the worst that could happen?", as part of your buying decision.
I hope this has been of interest.
Cheers Andy
photoree.com/photos/permalink/442852-8157165@N05Photoree, a photo search site; the source of this article's image.
scworld.com/perspective/iot-security-its-not-to-late-to-get-it-rightAn SC Media opinion piece arguing that it isn't too late to build security into the internet of things, and how to go about it.
en.wikipedia.org/wiki/Embedded_systemAn embedded system is a small computer built into a device to do a dedicated job, often with limited power, memory and means of updating.
en.wikipedia.org/wiki/Internet_of_thingsThe internet of things (IoT): everyday devices, such as cameras, TVs, thermostats and locks, that connect to the internet and to each other.
en.wikipedia.org/wiki/AbandonwareAbandonware is software, or a device's firmware, that its maker no longer supports or updates.
en.wikipedia.org/wiki/AbandonwareAbandonware is software, or a device's firmware, that its maker no longer supports or updates.
en.wikipedia.org/wiki/Amazon_Fire_TVAmazon's range of streaming sticks and boxes that plug into a TV and run its own apps.
en.wikipedia.org/wiki/ChromecastGoogle's range of streaming devices that plug into a TV's HDMI port and play content sent from a phone or computer.
en.wikipedia.org/wiki/Smart_TVA smart TV is a television with a built-in computer, operating system and internet connection for apps and streaming.
en.wikipedia.org/wiki/Trojan_horse_(computing)A trojan horse is malicious software disguised as, or hidden in, something trusted, which gives an attacker a way in once it is running.
en.wikipedia.org/wiki/Firewall_(computing)A firewall controls the traffic allowed between networks, such as between the internet and a home or office network.
arduino.ccArduino's home page. Arduino is an open-source electronics platform: small programmable boards and the software to program them, popular with hobbyists.
en.wikipedia.org/wiki/Home_automationHome automation controls a home's lighting, heating, locks, appliances and security remotely or by rules, through connected devices.
en.wikipedia.org/wiki/Attack_surfaceA system's attack surface is the sum of the points where an attacker could try to get in or extract data.
legislation.gov.uk/ukpga/2022/46/contentsThe UK's Product Security and Telecommunications Infrastructure Act 2022. Its product security regime, in force since April 2024, sets minimum security rules for consumer connected devices. This is its official text.
en.wikipedia.org/wiki/Cyber_Resilience_ActThe EU's Cyber Resilience Act (2024) sets security requirements for products with digital elements, including security updates for their expected lifetime. Most of its obligations apply from December 2027.
Thanks for reading. For more on cyber security, technology and leadership, subscribe to the mailing list, follow me on LinkedIn or subscribe to this blog's RSS feed.
By Andy Boura