Security and Privacy Challenges for IoT
Download as PPTX, PDF0 likes218 views
The document discusses four new privacy and security challenges posed by the Internet of Things (IoT): 1) intimacy of devices and data, 2) physical safety issues, 3) lack of awareness about devices, and 4) complexity and scale. It proposes approaches to address these issues, including better technical solutions, user experience design, developer support, and laws/policies. The speaker is developing an open-source IoT hub operating system and exploring ways to increase awareness of devices using low-cost LED or audio indicators. Overall, the document argues that existing approaches are insufficient for IoT and innovation is needed to ensure privacy and security as IoT adoption increases.
Security and Privacy Challenges for IoT
- 1. #RSAC SESSION ID: Jason Hong Security and Privacy Challenges for IoT SEM-M01E Professor Carnegie Mellon University @jas0nh0ng
- 2. #RSAC 2
- 3. #RSAC 3
- 4. #RSAC Four New IoT Challenges for Privacy and Security 1. Intimacy of Devices and Data 4 Fun Facts about Millennials – 83% sleep with their phones – 90% check first thing in morning – 1 in 3 use in bathroom
- 5. #RSAC Four New IoT Challenges for Privacy and Security 1. Intimacy of Devices and Data 5 Fun Facts about Millennials – 83% sleep with their phones – 90% check first thing in morning – 1 in 3 use in bathroom Our smartphones already know: – Who we know, where we go, what we like
- 6. #RSAC Four New IoT Challenges for Privacy and Security 1. Intimacy of Devices and Data 6 Fun Facts about Millennials – 83% sleep with their phones – 90% check first thing in morning – 1 in 3 use in bathroom Our smartphones already know: – Who we know, where we go, what we like Will only become more intimate with IoT – This also means new kinds of intrusive ads, data breaches, accidental data sharing
- 7. #RSAC Four New IoT Challenges for Privacy and Security 2. Physical Safety 7 Today, main problem is data breaches Tomorrow, huge potential for many nasty scenarios – Many new kinds of ransomware we haven’t imagined yet o Malware that locks people out of their houses o Malware that turns off thermostats in winter --> burst pipes – Holding people and society virtually hostage o Autonomous drones or vehicles deliberately crashing into things o Implanted medical devices giving or receiving fake data
- 8. #RSAC Four New IoT Challenges for Privacy and Security 3. Awareness of Devices 8 In my first year teaching at Carnegie Mellon, met with students in their lab Didn’t know until end of semester we were being broadcast on Internet the entire time! – Do you see the camera?
- 9. #RSAC Four New IoT Challenges for Privacy and Security 3. Awareness of Devices 9
- 10. #RSAC Four New IoT Challenges for Privacy and Security 3. Awareness of Devices 10 More and more devices will be hard to notice Ex. Mites “supersensor” under development at Carnegie Mellon See http://mites.io
- 11. #RSAC Four New IoT Challenges for Privacy and Security 4. Complexity and Scale 11 Lots of unexpected and emergent behaviors
- 12. #RSAC How to Address These Privacy and Security Issues? 12 Better technical approaches – Operating systems, networking, programming languages Better UX design – Better disclosures, awareness of devices, controls, decision making Better developer support – Most developers are C students – Tools, education, best practices for privacy and security Better laws, policies, and standards – Mandatory cybersecurity insurance for manufacturers – Tools to help policy makers, journalists, product reviewers
- 13. #RSAC How to Address These Privacy and Security Issues? 13 Better technical approaches – Operating systems, networking, programming languages Better UX design – Better disclosures, awareness of devices, controls, decision making Better developer support – Most developers are C students – Tools, education, best practices for privacy and security Better laws, policies, and standards – Mandatory cybersecurity insurance for manufacturers – Tools to help policy makers, journalists, product reviewers
- 14. #RSAC How to Address These Privacy and Security Issues? Operating Systems 14 Our team is developing an open source IoT Hub – Think of it as a smarter WiFi router that protects IoT devices How far can we go if devices have simple metadata? – Ex. Here is my URL for software updates – Ex. Here is my Manufacturer Usage Description (MUDs) o Whitelist: this lightbulb communicates only with lights.intel.com What basic services can IoT Hub offer for all devices? – Ex. Disallow remote login for devices if well-known default password – Ex. Centralize telemetry and learn patterns
- 15. #RSAC How to Address These Privacy and Security Issues? Awareness of Devices 15 Our team looking at physical dimension of IoT privacy – Ex. Make it easy to see where camera is and where it’s pointed – Want something cheap (so manufacturers will adopt) and effective – Testing out LEDs, audio, virtual maps LEDs off If device has camera -> LED on
- 16. #RSAC How to Address These Privacy and Security Issues? Awareness of Devices 16 LEDs off If device has camera -> LED on
- 17. #RSAC Summary 17 IoT poses many new challenges to privacy and security – Ex. Intimacy, physical security, awareness, complexity Existing approaches for privacy and security insufficient – Will require innovations in tech, UX, education, legal, standards We’re not going to have many second chances for IoT, and business as usual will be disastrous Let’s make sure we create a world we would want to live in Contact me at jasonh@cs.cmu.edu
- 18. #RSAC 18
- 19. #RSAC 19
Editor's Notes
- #3: https://commons.wikimedia.org/wiki/File:Dell_Desktop_Computer_in_school_classroom.jpg Two decades ago, computers were primarily large unattractive boxes that came with a monitor, keyboard, and mouse
- #4: Explosion of form factors Offer a lot of potential benefit to society, in terms of healthcare, urban planning, safety, and more But also pose new kinds of challenges to privacy and security
- #5: Some researchers have said that there is nothing new about privacy and security for IoT That it’s just the same as what we’re already facing I would strongly disagree Let me tell you about four new challenges for privacy and security for IoT
- #10: This is not a hypothetical problem, and it’s not just cameras too https://www.washingtonpost.com/technology/2019/01/17/airbnb-refunds-guest-who-found-indoor-cameras-during-his-familys-stay/?noredirect=on&utm_term=.b9131e272fd1 http://jeffreybigham.com/blog/2019/who-is-watching-you-in-your-airbnb.html#h.jbbecf75fxlp
- #11: This is not a hypothetical problem, and it’s not just cameras too https://www.washingtonpost.com/technology/2019/01/17/airbnb-refunds-guest-who-found-indoor-cameras-during-his-familys-stay/?noredirect=on&utm_term=.b9131e272fd1 http://jeffreybigham.com/blog/2019/who-is-watching-you-in-your-airbnb.html#h.jbbecf75fxlp
- #12: Ok Glass, take a picture -> everyone’s Glass took a picture We’ll have more and more examples of these kinds of unexpected behaviors as the number of devices increases