IoT security guidelines

Internet of Things devices utilize various sensors, advanced hardware, intelligent software and network connectivity to solve all sorts of problems. Many of them automate data collection and processing, helping people take better decisions, and sometimes even taking smart decisions themselves! According to Gartner, there will be over 25 billion IoT devices in use by 2021.

Lots of people make use of IoT wearables to track various aspects of their lives, for example. And businesses utilize Internet of Things technologies to get new customers, reduce product and/or service development costs, increase productivity, boost the reliability of their operations, and so on.

However, a recent Data Alliance report highlights some of the key disadvantages that arise from using IoT devices. For starters, they can't exchange information with other devices properly, unless they have been built with this very purpose in mind. And even when they can communicate directly, device maintenance will quickly become very complex, as some Internet of Things technologies decline, and others reach their maturity. Add to this the lack of compliance, which is a very pressing, and yet almost impossible to solve issue, and you will start to understand some of the most important IoT challenges.

However, when it comes to using Internet of Things devices, the biggest issue by far is poor security, which can leave user/company data exposed to a great variety of cyber attacks. And since we've got so many devices in use, as well as a huge number of attack vectors, it looks like the problem won't get solved anytime soon.

Industrial Internet of Things (IIoT) systems can successfully manage the infrastructure of most smart cities, helping their citizens live better lives. However, they can also be attacked by cyber criminals, who may be able to shut down entire power plants, for example. So, what can people do to improve IoT security?

Everything begins with device security. Smartphone manufacturers have created dedicated chips which provide powerful security features. Google's Titan M prevents the attackers from unlocking the bootloader and logging into your phone, by storing the required data into a dedicated flash memory which isn't accessible to the operating system, for example. And Samsung's Knox chipset ensures that only the approved software components are loaded in memory, utilizing digital certificates to verify each application.

Software security is essential as well. Known vulnerability sources (code reused from abandoned open source libraries and components, etc.) should be avoided, because they may introduce huge security holes. Ports should be open only when the IoT device is supposed to send and receive data, and closed immediately after that.

Unencrypted data communication should be avoided as well. Companies are responsible for protecting user information while it travels across the Internet, and for as long as it is being stored on their devices. It helps to have trained employees who understand the complexity of IoT security, or at least to work with a team of skilled consultants.

Most IoT devices will be shipped with bugs; it is almost impossible to build a product that is 100% safe from the very beginning. However, it's not complicated to create a product that can be patched quickly and safely, and it's a pity that many manufacturers, who are only interested in making a quick profit, create devices that can't be patched. So, do your best to ensure that the IoT solution maker has built a product that can be patched remotely.

Network security is the last piece of the puzzle. You should always use products that enforce strong user authentication methods, which guarantee that unauthorized users aren't allowed to log into the system. Passwords should be long enough to withstand brute force attacks, and 2-factor authentication (2FA) should be used whenever it is possible to do so.

As you can see, IoT security can pose serious challenges to businesses of all sizes. However, by following these guidelines, most risks will be eliminated.