Kevin-IoTSecurity_ISOC PPT on Internet of Things
- 1. IoT: Privacy and Security Kevin G. Chege ISOC Chapters Workshop Addis Ababa, 2019
- 2. Privacy, Security and IoT • Privacy is about retaining the ability to disclose data consensually, and with expectations about the context and scope of sharing. • With online privacy, we wish to ensure that our personal data is not disclosed to third parties without our knowledge or consent • As with any online service, IoT Privacy and IoT Security are linked and complement each other: • Entering your password via a un-secured IoT device risks eaves-droppers from stealing your identity • If your mobile phone lacks a password and is stolen, your personal data like call logs, messages, photos etc can be accessed
- 3. There are two ways to view IoT Security •Outward Security • Focus on potential harms that compromised devices and systems can inflict on the Internet and other users •Inward Security • Focus on potential harms to the health, safety, and privacy of device users and their property stemming from compromised IoT devices and systems 3
- 4. Outward Security: Impact of Cyber Security issues 4
- 5. Inward Security: What risks do insecure IoT devices bring to Privacy and Security? • Using insecure IoT Devices increases the risks of personal data being exposed/stolen and privacy compromised: • A smart camera using default username and password combination can be used to spy on you or be compromised to send junk information to the Internet • A wearable smart device that sends health information over un- encrypted channels can expose personal data • A smart home device like a television that lacks sufficient updates can be vulnerable to new attacks and be used to share private data • Smart vehicles running insecure software can be accessed remotely and compromised to disable certain functions of the car
- 6. 6 Economics favor weak IoT security • Strong security can be expensive to design and implement, and it lengthens the time it takes to get a product to market. • The commercial value of user data also means that there is an incentive to hoard as much data for as long as possible • There is currently a shortage of credible ways for suppliers to signal their level of security to consumers (e.g., certifications and trustmarks). • The cost and impact of poor security tend to fall on the consumer and other Internet users, rather than on the producers of IoT systems
- 7. How can IoT Security be improved? • Collaborative approach: sharing of information by users, vendors, manufacturers on security breaches and best practices • Strong policy controls for example: • Requiring encryption in devices: IoT devices should use encryption in order to make it very difficult for a 3rd party to eavesdrop on communications • Frameworks on device features and capabilities • User Education for example: • Train users on preferring stronger passwords on IoT Devices • Consumer Demand for devices to have certain eg using two factor authentication: a password (something you know) and a token (something you have). • Train users to identify insecure devices and avoid them
- 8. 8 How do we improve things? • Research and Innovation • Open Standards • Certifications and Trustmarks • Policy and Regulation • Frameworks and Best Practices
- 9. Visit us at www.internetsociety.org Follow us @internetsociety Galerie Jean-Malbuisson 15, CH-1204 Geneva, Switzerland. +41 22 807 1444 1775 Wiehle Avenue, Suite 201, Reston, VA 20190-5108 USA. +1 703 439 2120 Thank you. chege@isoc.org
Editor's Notes
- #3: Example of outward risk: A home appliance may continue to function well as far as the direct user is concerned, and s/he may be unaware that it is part of a botnet participating in a DDoS attack Toaster example: - Someone may use it against you, and remotely decide to burn your hands our even your house (inward security related issue) Your toaster works ok but is being used for a major DDOS attack (outward) At ISOC, our focus is on the impact that IoT security and privacy has on the Internet and other users.
- #8: (new technologies, better user interfaces, better development tools)