The Internet of Things (IoT) has positively exploded into our daily lives. We see IoT devices everywhere, from our workplace to our homes. It is inevitable that a new technology will become ubiquitous after it hits the headlines, and thanks to the IoT, many have done just that--repeatedly—even if the headlines aren’t always positive.
For instance, my daughter had an IoT toy that experienced a similar furor—a beloved doll called “My Friend Cayla.” My daughter would ask the doll a question, which was then sent to an app that converted it to text. The text was then used to look the answer up online before returning the answer to the doll, and Cayla would then speak the answer back to my daughter.
That’s cute and exciting for a toy, but for a privacy expert, it was a bit creepy. In fact, German regulators agreed on the last sentiment and were concerned. They saw “My Friend Cayla” more as “My Spy Cayla,” and
But look at the bright side—it can also be technology used for good.
Beneficial IoT tech doesn’t even have to be worn—these days, you can even get a "
To make the most of what can be empowering technology, that technology must be simultaneously optimized to do its job while also not exposing personal data, as they do generate a generous amount of it. They also, generally, are custodians of other Personally Identifiable Information (PII), such as name, address, passwords and even your physical location. In the case of the man saved by his Fitbit, his wife gave consent to the doctors at that time to use that information created by the device, but what should or could be done if a location-enabled IoT device was utilized criminally to stalk someone?
With the following tips, you can help to keep the risk of leaked or stolen information to a minimum.
Tip #1: Buy Your IoT Device from a Known Supplier
Once you start using an IoT device, you will need to share your own PII and potentially lots of other types of data, depending on the device. This can include health data, home utility information, and your location. All these data sets are sent to a cloud repository—often via a mobile app. That’s a significant amount of personal data being shared with a third party, so it’s important to check the credibility of the supplier when purchasing an IoT device. Established suppliers with brand equity are more likely to adhere to industry standards and best practices like using “secure-coding,” security and privacy by design, and pushing regular software updates. Act like a lawyer and read the supplier's privacy policy. Identify why they must use your data, and make sure they don't include draconian clauses for reselling your data onto third parties. And if their privacy policy doesn’t exist? Don’t even consider buying.
Tip #2: Secure Your Wi-Fi
Our homes are now becoming the hub of IoT devices. The “smart-home” is no longer science fiction but attainable for many people able to purchase devices such as the Nest, Ring Doorbell, and Amazon Echo that are easily available. To keep your smart home secure, you need to keep your home router secure. One of the main security issues of routers is that many come with default passwords. These passwords are often guessable, or brute forced by hackers. Change your router password to be complex as soon as you set up the router.
Tip #3: Keep your IoT Device Up to Date
The
Tip #4: Keep Your Mobile Secure Too
Mobile apps and IoT devices often go together - the IoT sensors transfer data back to the app so it can be visualized by the human operator. Keeping your mobile phone secure by ensuring that the latest updates are installed helps keep your IoT-generated data safe. Also, make sure that the app you use with an IoT device is downloaded from a safe site, such as the manufacturer’s website or a legitimate app store. When you install the mobile app, check out the settings and ensure privacy permissions reflect your comfort level, including the configuration of the location services.
Tip #5: Device Stock Check
IoT devices are meant to connect to one another. In a home setting, for example, you can use Alexa to switch IoT light bulbs on and off, or open and close curtains, and so on. As such, you could potentially end up with several individual IoT devices linked together, so keeping an IoT device inventory would be smart. A tool like Cujo could help, as it keeps track of all devices connected to the internet, so you know what you need to secure, allowing you to then more easily control any situation. Keeping track of how your devices are operating will let you have an early view of unauthorized access.
(Editor's Note: Avani will be speaking on a panel in the session “Increasing Trust in the IoT Through Auditing” at the upcoming GRC Conference 2018 in Nashville, Tennessee).
(This post originally appeared on the ISACA blog, which can be viewed
