Addressing Identity of Things With Industry Collaboration to Bolster IoT Security

The Australian government recently released a voluntary code of practice on ‘Securing the IoT for consumers‘, outlining 13 areas to provide the industry with the best tools to design IoT devices while maintaining cybersecurity.

Attacks are growing in complexity and sophistication. We’ve all heard the horror stories of what can happen when cybercriminals access vulnerable IoT devices: grab photos of your kid; drain your bank account; alter your health records; hold your coffee maker, thermostat or vehicle hostage; and stop your heart (if you have a pacemaker).

In addition to personal and business vulnerability where devices can be held hostage for ransom or more directly nefarious intent, unprotected IoT devices can provide easy ways for malicious actors to cause global damage, as can the apps that support them.

For businesses creating IoT devices and supporting apps, this will mean re-addressing the entire product life cycle with an emphasis on security. For organisations employing IoT devices, it will mean having a methodical approach to their security. Consumers, who are showing interest in purchasing an ever-increasing number of IoT devices, will be protected by security being built in into products from conception.

Get on the front foot of the Identity of Things

The new Code has identified the top three priorities in the short term as default passwords, vulnerability disclosure and security updates.

Reliance on common credentials without encryption is part of what made it so easy for persistent botnets like Mirai to target vulnerabilities in IoT products. Immediate mitigation measures should include securing the devices you have now and devices coming online with well-encrypted (hashed and salted) passwords can provide a strong line of defence. Multifactor authentication (MFA) also offers the possibility of securing devices with other factors like geographic location or time.

To truly advance our defences against the rising threats, the conversation around IoT security needs to broaden to encompass the “Identity of Things.” Connected devices not only gather data about us as individuals, but also our pets, robots, cars, appliances, and anything else on the network. Identity management must universally encompass all of these use cases and scale, securely, as more ‘things’ become connected.

IoT brands need to make a proactive investment in security and privacy, and specifically in the management of identity. The upfront investment on the privacy of their consumers and trust is going to have to become a priority, along with time to market and quarter over quarter profits.

What is becoming abundantly clear is that no one company or individual can address the IoT security problem on their own. The industry is going to need to tackle this together.

Cross-industry collaboration key to securing the Identity of Things

The IoT wave is moving so fast, and in so many directions. As the threat of attacks become more complex and sophisticated, there is a need for adjacent technologies to build on one another.

The recently launched Auth0 Marketplace is an example of how collaborative platforms can allow technologies to leverage each other’s different expertise and capabilities to solve the burgeoning security issues and better deliver value to their users.

Collectively, device manufacturers and app developers will be in a stronger position to respond to new business challenges and defend against new threats. By sharing intelligence and knowledge, there is a greater chance for the various IoT brands to address IoT security as an architecture, identify innovative use cases and interactions and conduct threat modelling.

IoT devices are just devices like any other on the internet, and the same pillars of confidentiality and integrity apply to them as they do to banking, communications and supply chain systems.

By leveraging today’s core mobile-first, cloud-based, platform technologies and adding to them the knowledge of industry partners, IoT technologies can build stronger and higher value offerings that encompass greater expertise in data, sensors, machine learning and automated customer experience.

The code is a positive step towards instilling greater confidence in IoT. Users should demand security and privacy best practices from every brand they interact with, and they are best accessed when the industry commits to collaboration. Security then becomes a matter of revenue, and there is no greater motivator to break down industry barriers.

IoT players that don’t make security part of their brand will lose customers to competitors who do. By establishing strong partnerships to strengthen IoT’s defences as an industry, both businesses and consumers alike stand to reap the benefits of greater IoT adoption.

Photo and Link: https://www.cpomagazine.com/cyber-security/addressing-identity-of-things-with-industry-collaboration-to-bolster-iot-security/