The Internet of things paradox
Download as PPTX, PDF0 likes306 views
This document discusses the security risks of internet-connected home security devices. It notes that Gartner forecasts nearly 25 billion internet-connected devices by 2020. The top vulnerabilities identified include privacy concerns over data collection, weak authentication through default usernames/passwords, and unauthorized access to live video feeds through hacked cloud or mobile accounts. The document recommends incorporating security into device design, using strong unique passwords, and limiting access to trusted users only.
The Internet of things paradox
- 1. The Home Security: Internet of Things Paradox Presented by: Golden LocksmithSurvey by: HP Is home security really secure?
- 2. Gartner, Ins. Forecasts that 4.9 billion connected things will be in use in 2015, up 30 percent from 2014, and will reach 25 billion by 2020. Deficiencies Include: Authentication Authorization Cloud Interfaces Mobile Interfaces Privacy
- 4. Vulnerable To Account Harvesting Unrestricted account enumeration: The ability to determine whether a specific account is valid on a system. Weak Password Policy: The lack of a policy and/or the presence of a weak policy. Lack of account lockout mechanism: The failure to lock out an account after a certail number of failed access attempts.
- 5. Account Harvesting is exacerbated when video access is granted to additional users such as family members or neighbors.
- 6. Top 5 Vulnerable Categories Identified Privacy (100%) – raised privacy concerns regarding the collection of names, addresses, dates of birth, phone numbers, and even credit card numbers. Video image leaks are also an area of concern. Authorization (100%) – an attacker can use vulnerabilities such as weak passwords, insecure password recovery mechanisms, and poorly protected credentials to gain access to a system. Insecure Cloud (70%) – cloud-based web interfaces exhibit account enumeration concerns. Insecure Mobile (50%) have enumeration concerns with their mobile application interface. Insecure software/fireware (60%) – did not include obvious update capabilities
- 7. Are You The Only One Monitoring Your Home? If video streaming is available through a cloud-based web or mobile application interface, then video can be viewed by an internet-based attacker from hacked accounts anywhere in the world.
- 8. Three Action To Mitigate Risks Include security in feature considerations when evaluating potential IoT product purchases Avoid using system defaults for usernames and passwords whenever possible, and choose good passwords, when the option is available. Don’t share account access with anyone outside your immediate family and stress secure password practices with those who have access.
- 9. The Federal Trade Commission (FTC) recommends that IoT device manufactures incorporate security into the design of connected products.