Security Research Day Summary of Input
1 like233 views
This document summarizes input from an open call on issues regarding the adoption, economic value, standards/governance, privacy/trust, and safety/security of IoT. Some of the key challenges mentioned include the need for transparency to drive adoption, understanding security to properly value it, fragmented standards, balancing privacy and clinical benefits, and restricting technical security approaches due to limited IoT device resources. Providing demonstrators, reducing development costs, and sharing best practices were suggested to help address some of these issues.
Security Research Day Summary of Input
- 1. #IoTUK @IoTUKNews iotuk.org.uk SUMMARY OF INPUT FROM THE OPEN CALL
- 2. Adoption and Acceptability “Adoption & acceptability will depend on transparency and rigor” “A citizen can and will have multiple identities (personas)” “Design should be informed by speaking with real people about their fears, struggles and preferences” “Smart cities face challenges of both scale and diversity, to provide services in an inclusive way” “The main barrier to acceptability is the fear of vendor lock- in and planned obsolescence” “Open and free-to-use demonstrators will help adoption” 12
- 3. Harnessing Economic Value “Who will actually pay for security?” “Safety & security is not well understood in the general market and is thus undervalued” “Availability of platforms is challenged by the complex and diverse nature of IoT” “It’s a challenge to implement required functionality in a risk-proportionate, cost-effective, timely and convenient way” “The cost of developing application-specific IoT systems needs to be dramatically reduced” “We need to remove lengthy development cycles and share best practices” 13
- 4. Standards, Governance and Policy “Standards will be required to set out best practice” “National standards will not suffice given the global nature of the infrastructure and market” “Standards are too fragmented, no one knows which standards will prevail” “Pragmatically there are enough standardised technologies to deploy interoperable IoT” “IoT and cyber lack proper definition” “IoT should follow the ‘Internet Model’ of broad consensus and running code” “Improvements in regulation will be necessary for medical IoT and other solutions that have physical consequences” 14
- 5. Privacy and Trust “Trust stems from an accepted level of assurance around an identity” “For healthcare, we need to offset clinical benefits vs. data privacy and ethics issues” “Consumers need a way to determine the balance of risk” “We need to strike a new balance between usability, security, reliability and privacy” “There are challenges specifically in the areas of user choice and consent” “Designers should make user security a priority to protect against fraud” “Complying with legal access requirements while preserving privacy requires a new security architecture for IoT systems” 15
- 6. Safety and Security “Many of our programmers are self-taught and struggle from a lack of comprehensive guidance “How do you do DevSecOps? “IoT security is complex because processing power is limited and networks are low bandwidth with small packets “Mobile devices lack a consistent protected store (Secure Element) to protect against malware or physical tampering” “Implementers do not provide necessary security controls early enough in the development life cycle” “Limited resources of IoT devices restrict technical approaches to security” “Small companies that want to innovate in IoT security face significant challenges in promoting awareness” 16