The Internet of Things (IoT) combines cutting-edge technology and innovation with everyday devices. Thanks to IoT; I can control my thermostat from anywhere, check out what's in the fridge, start my car from my phone, and even analyze how I slept last night. There is no question that the technology is amazing, but I do have one MAJOR question. What happened to security when people were designing these things? It seems like everyone just focused on the fun stuff, and left security completely out of the equation.
I usually use studies and research to back up my stories, but for this I wanted to try something different. I wanted to show how many IoT security concerns have been reported in the past couple of weeks. A simple Google search tells the story of the "Internet of Unsecure Things." These are just a few of the headlines from the last two weeks.
IoT headlines - Is any of it secure?
Shodan: The IoT search engine for watching sleeping kids and bedroom antics
Internet of Things: cyber crime on the rise
A GPS Tracker for Kids Had a Bug That Would Let Hackers Stalk Them
Internet-Connected Fisher Price Teddy Bear Left Kids' Identities Exposed
Report examines the massive future cybersecurity problem of connected cars
Many SmartHome and IoT Devices Have Lttle or No Security
Who regulates these things?
No one, that's one of the main problems. Perhaps, companies are in such a hurry to release the next best thing that security is just not a priority. Maybe I'm alone in this opinion, but if companies have the technology to create such cutting-edge products, then shouldn't they have the means to secure them? If nothing else, it seems like someone would be able to detect flaws before a product hits store shelves. Controlled experiments have already shown that critical medical devices, like pacemakers and insulin pumps, can be hacked. While extreme, this is a life-threatening situation that must be addressed. It's mind blowing that such serious security problems are approached with a trial and error attitude.
Don't count on the government
The Cybersecurity Information Sharing Act, oh boy. CISA is a hot button issue, with many people raising concerns over privacy. The legislation was designed to allow companies to share information, including private data, on cyber-attacks. The information can now be shared with other companies and the Department of Homeland Security. Many believe that the legislation opens the door for the government to spy on people, by looking at their private data. While the privacy concerns are valid, it seems more concerning that this is the best that the governement could do. The notion is too little, too late. Sharing information after the fact is not exactly proactive, and does little to hold people accountable.
What now?
With new devices rolling out by the second, and government regulation lagging so far behind, it looks like IoT security will continue to suffer for the foreseeable future. Eventually, IoT regulations will come around (surely?), but who knows what it will take for that happen.