Consumers Have the Power in IoT Security

Written by Angela Orebaugh, PhD, Program Director and Faculty for the Certificate in Cybersecurity, UVA School of Continuing and Professional Studies

We are commencing an age of solutions.  The Internet of Things (IoT) is enabling us to realize efficiencies and new opportunities for growth across many verticals through a convergence of operational technology (OT) and information technology (IT).  The IoT ecosystem of smart devices, cloud storage, and data analytics is creating dynamic solutions to large scale, long-term problems.  For example, as smart cities evolve, the IoT will help solve some longstanding problems in the areas of transportation, emergency response, and utilities.  IoT efficiencies can save billions of dollars across many markets including transportation, health, building automation, and manufacturing.

While the IoT offers efficiencies and opportunities for growth, it also offers a number of cyber security challenges.  As IoT solutions are implemented, the growth of the cyber attack surface grows exponentially.  For example, a single heating and air conditioning system within a building may have hundreds of sensors that could each act as an attack entry point.  These smart sensors won’t have built in firewalls, anti-virus, or intrusion detection, so new security models and controls are needed to manage risk in the IoT ecosystem.  IoT devices may be compromised and used as part of a botnet to launch distributed denial of services attacks (DDoS), such as the attack that rendered Dyn clients inaccessible in October 2016.

In the IoT ecosystem, the greatest cyber security concerns include health and safety.  This is due to the OT/IT convergence where operational technology, such as bridges, implanted medical devices, or energy plants are managed and controlled by information technology such as remote management systems or apps.  In the case of controlling traffic through embedded sensors that are communicating information in real time, an attack on these devices could lead to accidents and fatalities.  The consequences of a cyber security attack in verticals that affect health and safety are far greater than the inconvenience of a DDoS attack on a domain name service provider.  It is important to make sure that the exciting new IoT opportunities don’t overshadow the importance of security and privacy in this emerging ecosystem.

An important differentiator in the IoT movement is that it is largely consumer driven.  Now more than ever consumers are in a strong position to have their voice heard.  Products and companies that aren’t bringing the right efficiencies and benefits to the consumer are failing.  Companies who are listening to consumer needs and requirements are becoming quite successful.  Now is the time for consumers to use their voice and purchasing power to demand security and privacy in IoT solutions.  As a consumer you have the power to make an impact in the future of the IoT by:

1. Becoming educated on how your IoT products operate and how they are secured, what data is collected and how it is stored and shared.
2. Letting product vendors know that you want security features built into the products you are purchasing.
3. Purchasing products with built-in security features and letting vendors know your reasons for purchasing or not purchasing their product.

We’ve already seen the impact of consumers shaping the market by driving demand for IoT products and features.  Now use your voice to drive innovation and ensure a secure convergence of technologies to enable a more efficient, prosperous, and secure future.