The term Internet of Things (IoT) has almost been beaten to death at this point, as more and more security integrators, manufacturers and customers take advantage of the ability to increase connectivity between devices (and therefore take on the dangers this introduces).

But the methods by which we interact with the IoT and protect its devices are still catching up, which means security manufacturers must take part in shifting their focus toward safeguarding data, engaging in vulnerability testing of products and incorporating stringent protections at every stage of the product development process. One small leak or breach on a single connected device can potentially cause significant damage across an organization

Who Is Responsible For IoT Security?

One small leak or breach on a single connected device can potentially cause significant damage across an organization, creating a disruption within a company, affecting its assets, employees and customers. The continued question seems to be: Who is ultimately responsible for the security of IoT devices?

In a recent survey from Radware, a provider of application delivery and cybersecurity solutions, there was no clear consensus among security executives when asked this question. Thirty-five percent of respondents placed responsibility on the organization managing the network, 34 percent said the manufacturer and 21 percent chose the consumers using the devices as being primarily responsible. 

Several schools of thought Exist For Each:

  • The Organization

It's not surprising that most people see the organization as the main stakeholder for IoT security responsibility; after all, if a company is managing a network, one would expect it to protect the network as well.
One way that the organization can embrace this responsibility is by adopting a user-centric design with scalability, tactical data storage and access with appropriate identification and security features (for example, the use of multilevel authentication through biometrics in access control).
Organizations must also use their IT team to strengthen the overall cybersecurity of the IoT by keeping up with the latest software updates, following proper data safety protocols and practicing vulnerability testing.

  • The Manufacturer

Manufacturers that provide IoT-enabled devices as part of a security system must be fully knowledgeable of the risks involved and effectively communicate them to the integrator or end user.
Providing the education necessary and dedication to protecting users of its equipment makes a manufacturer more trustworthy and understanding in the eyes of an end user. Ensuring encryption between devices is a key step that manufacturers can take to work toward achieving complete protection in the IoT.

  • The User

Despite the protection delivered by the organization and manufacturer, there's always the option for IoT security to be enhanced or possibly even diminished by the individual user. It's critical that best practices for data protection are in place every time an individual uses a device that is connected to the network.
These include disabling default credentials, proper password etiquette, safe sharing of sensitive information and the instinct to avoid any suspicious activity or requests. Manufacturers that provide IoT-enabled devices as part of a security system must be fully knowledgeable of the risks involved

The short answer to the responsibility question is this: everyone. Each sector has a responsibility to contribute to the protections needed for IoT-enabled devices.

However, as a manufacturer, it is imperative that our teams think about each level of protection when developing products for public consumption, including how the organization implements the technology and how the integrator engages in training with users. 

IoT issues caused by organisations
Organizations must also use their IT team to strengthen the overall cybersecurity of the IoT by keeping up with the latest software updates

Manufacturer Vulnerability Testing

One way that manufacturers can implement added protections against outside threats is by boosting their attention to security protocols in the product development stage. For some, this requires a different approach in the design and development of security systems. Identifying vulnerabilities is at the core of this.

A security vulnerability in a product is a pattern of conditions in the design of a system that is unable to prevent an attack, resulting in weaknesses of the system such as mishandling, deleting, altering or extracting data. Increased connectivity makes these vulnerabilities more of a liability, as IP-enabled (or networked) devices are more likely to be breached by outsiders looking to permeate an organization and collect valuable data. 

A security vulberability in a product is a pattern of conditions in the design of a system that is unable to prevent an attack, resulting in weaknesses of the systemWhile some of these hacks are a little more “simple” in nature — such as outsiders trying to guess a password using manufacturer-set passwords — others are more complex, such as a denial-of-service, where attackers attempt to overload the system by flooding the target with excessive demands and preventing legitimate requests from being carried out. This makes it virtually impossible to stop the attack by blocking a single source.  

As a result of these potential threats — and to help manufacturers deliver best-in-class products — it's imperative that vulnerability testing is done throughout a product's development, starting at phase one in the process.

This includes analysis of the type of cyberattacks that can potentially attach, breach and disable a system. Many manufacturers attempt to hack their own products from within the organization — or even go as far as hiring a third-party professional group to do it for them. 

Success In A Volatile Technology Landscape 

This kind of development puts a product through rigorous levels of testing, and once weaknesses are exposed, they can be patched up and the cycle of attack-and-defense can take place until the product is protected fully and ready for market.

Skipping this step in the development process can open manufacturers up to significant liability, so it's important for this testing to take place and corrective actions be taken to rectify gaps in security. The more extensive an organization's security testing approaches are, the better are its chances of succeeding in an increasingly volatile technology landscape. 

But the testing doesn't stop in the development stage. Attacks on a system continue long after the product has been introduced to market, requiring continued updates to be made available in an effort to protect customers. Manufacturers are tasked with implementing further firmware updates to keep a product in the field readily prepared to revoke the latest critical bugs that can affect the market. 

What End Users Demand From Security

We're seeing a significant shift in the education and demand from a customer perspective. In the past, consumers took the advice of integrators and consultants as far as the “right” security systems to install for their needs. Today, the self-education of end users is on the rise as more and more IT departments become involved in the selection and investment of physical access control systems. We're seeing a significant shift in the education and demand from a customer perspective

A larger number of end users are demanding security products that meet IT standards of network protection, and they take these considerations into account when working with integrator partners on the selection of systems to meet their needs.

As a result, manufacturers are tasked with not only developing robust IoT-centric products, but also continuing to be involved on a regular basis in an effort to continuously keep organizations safe. 

A comprehensive security strategy from manufacturers must involve multiple levels of product selection, testing and integration — centered on the team-based approach to implementing training and protocols within an organization.

While manufacturers are stepping up their game in the development of robust products, this remains a team effort that must be addressed every week — not something you implement, then forget about. The safety of data — and the entire organization — depends on it.

Share with LinkedIn Share with Twitter Share with Facebook Share with Facebook
Download PDF version

Author profile

Kim Loy Director of Technology and Communications, Vanderbilt Industries

In case you missed it

Motorola Solutions Acquires Pelco For $110 Million
Motorola Solutions Acquires Pelco For $110 Million

Motorola Solutions, Inc. today announced it has completed the acquisition of Pelco, Inc., a global provider of video security solutions based in Fresno, California. Pelco designs, develops and distributes end-to-end video technology, including video security cameras and video management system software. The company’s scalable solutions and commitment to service delivery enables customers of all sizes to mitigate risk, increase operational efficiencies and enhance safety.  “Video continues to play a more powerful role in enabling safer cities and securing businesses around the world,” said Greg Brown, chairman and CEO, Motorola Solutions. “Pelco’s track record of innovation, internationally recognized brand, global channel and customer installed base enable us to further expand our global footprint with enterprise and public safety customers.”

What are the Security Challenges of Protecting the Cannabis Industry?
What are the Security Challenges of Protecting the Cannabis Industry?

The advent of a truly new market for the physical security industry is a rare occurrence. Particularly rare is a new market that is both fast-growing and provides an environment that is not just conducive to application of physical security technologies but that actually demands it. Such is the case with the market for legalized marijuana. We asked this week’s Expert Panel Roundtable: What are the security challenges of protecting the cannabis industry?

Wireless Technology Is Transforming Motion Detection
Wireless Technology Is Transforming Motion Detection

Motion detection is a key feature of security systems in residential and commercial environments. Until recently, systems have relied heavily on closed circuit television (CCTV) and passive infrared (PIR) sensors, which both require significant investment and infrastructure to install and monitor. Developments in wireless technology are increasing home security possibilities. Few years ago, these developments led Cognitive Systems to discover that the wireless signals surrounding oneself can be used to detect motion. Known in the wireless industry as WiFi sensing, this technology brings many benefits that other motion detection solutions have not been able to provide. The working of WiFi sensing At Cognitive Systems, the company has used WiFi sensing technology to develop a motion detection solution called WiFi Motion™, which measures and interprets disruptions in RF signals transmitted between WiFi devices. When movement occurs in a space, ripples in the wireless signals are created. WiFi Motion interprets these ripples and determines if an action, such as sending a notification, is needed. Enabling this functionality in a space is incredibly simple. With a software upgrade to only one’s WiFi access point (or mesh router), motion sensing capabilities are layered into one’s WiFi network. Existing connected WiFi devices then become motion detectors without detracting from their original functions or slowing down the network. Using artificial intelligence (AI), WiFi Motion establishes a benchmark of the motionless environment and learns movement patterns over time, which could be used to predict trends. This allows unusual movement patterns to be detected with greater accuracy while decreasing the potential for costly false alerts. WiFi Motion requires no line-of-sight or installation WiFi sensing and other home monitoring solutions All of these capabilities are made possible by WiFi sensing and together create a motion detection system that provides unparalleled accuracy, coverage, privacy and affordability compared to other solutions on the market. PIR integration is far more complex and imposes electronic and physical design restrictions compared to WiFi sensing. In terms of placement, PIR systems are difficult to install, requiring line-of-sight and a device in every room for localization. WiFi Motion requires no line-of-sight or installation and is also a scalable solution compared to PIR. Much like cameras, PIRs can only cover so much space, but WiFi Motion can cover the entire home and even detect motion in the dark and through walls, without adding additional devices to the home. WiFi Motion detects less distinguishing context than cameras and microphones, but more context than regular PIR sensors for the perfect balance of privacy and highly accurate motion detection. Privacy solution While cameras have been the security solution for years, WiFi Motion offers a more affordable solution that can rival the privacy and coverage capabilities of even the most high-end cameras. With such a wide coverage area, one might think that WiFi sensing infringes on privacy, but actually, the opposite is true. With WiFi Motion, the contextual information collected cannot be used to identify a specific individual, unlike cameras which can clearly identify a person’s face or microphones, which can identify a person’s voice. It is different from other smart home security options that use cameras and microphones because it only senses motion using WiFi signals - it doesn’t “see” or “listen” like a camera or microphone would. This provides opportunities for added security in spaces where privacy might be a concern and installing a camera may not be a comfortable solution, such as bathrooms and bedrooms. The data collected is also anonymized and highly encrypted according to stringent industry privacy standards. Existing connected WiFi devices then become motion detectors Additional WiFi sensing applications Since WiFi sensing technology requires no additional hardware or subscription fees, it is much more affordable than other motion detection solutions. It can be used as a standalone solution, or it can be easily layered into more complex systems. This ease of integration, scalability and relatively low cost brings a lot of potential for various applications. Motion detection can trigger other smart devices in the network to turn lights on or off In eldercare, for example, WiFi sensing can be used to help seniors live comfortably in their homes for as long as possible. With the increasing aging population and high costs associated with care homes, the market for this application is considerable. Caregivers can use an app to monitor movement in their loved one’s home and be alerted about unusual movement patterns that could indicate a concern. For smart homes and other environments that have a network of smart devices, the artificial intelligence (AI) component of the technology allows for improvements to automated features. Motion detection can trigger other smart devices in the network to turn lights on or off or make adjustments to the temperature in a room. Security for the commercial sector For office buildings and other commercial properties, it is easy to see how all of these features could be scaled up to offer a highly accurate and cost-effective motion sensing and smart device automation solution. Cognitive Systems is closely involved with the development of WiFi sensing technology, working with various industry groups to establish standards and help it reach its full potential. WiFi Motion is merely the tip of the iceberg in terms of motion sensing possibilities, but its applications in the world of security are undeniably compelling. It is an exciting time for the wireless industry, as one works with stakeholders in the security space to explore everything this technology can do.