This report explores security concerns involving Internet of Things (IoT) devices and the cybersecurity risks they can create. It discusses examples of IoT-related threats, including the Mirai botnet, and examines how human behavior, regulations, and international cooperation can affect IoT security. This artifact demonstrates my ability to research a cybersecurity topic from multiple disciplinary perspectives. Through this report, I demonstrate that cybersecurity is not only a technical concern but also requires insights from other disciplines to better understand complex problems.
IoT Security
The Internet of Things is a growing aspect of technology quickly making its way into many lives. As IoT devices grow they are finding their way to normal consumers, industrial markets, and commercial markets. Some examples of IoT appliances are smart watches, smart speakers, sensors on machinery, tracking devices for fleet vehicles, and devices used in healthcare. The growth of IoT has been revolutionary, but it also has come with concerns regarding the security of the devices. The security of IoT devices has come with problems such as weak authentication and passwords, lack of encryption on data, and containing vulnerable software. While many think this only concerns cybersecurity, it is a problem that also requires views from other disciplines to help solve the problem. The combination of these disciplines helps show the many sides of the problem to gather a full understanding of IoT security and how to solve the problem.
Cybersecurity
Cybersecurity, one of the main disciplines in IoT security, looks to networks and the protection of data and devices on the network. From the cybersecurity view of IoT security, “these devices cause many vulnerabilities that appear as a fertile ground for cyber threats” (Abdullah). Exploits on these devices can be based on hardware, software, or network limitations on IoT devices. These limitations open up easy vulnerabilities for bad actors to exploit. One of the vulnerabilities related to IoT devices is the weak encryption, many have criticized the encryption on IoT devices and cybersecurity looks to add stronger encryption for IoT devices.
Another technical challenge that comes up is that most IoT devices are operating 24/7. This makes IoT devices likely targets for botnets, because of the availability of these devices, bad actors may be encouraged to use these devices in their botnets to perform bigger attacks. An example of this was the Mirai botnet, which attacked sites such as Twitter, Reddit, and Netflix “resulting in unavailability of the web sites” for hours (Schiller). These botnets can consist of thousands of IoT devices that were highjacked by bad actors for often bad purposes, such as launching the bots to a network to overload traffic causing the system to go down for a period of time. These botnets can be used for other purposes though, such as “send spam email, steal credit card information” and the list goes on, as long as the bad actor has control of the device and it has connection to the internet it can be used negatively (“Cloudfare”).
IoT security has another challenge, weak passwords. Weak passwords were also how the Mirai botnet came to be, it searched for IoT devices with a default password where it was “able to log into the device and infect it” (“Cloudfare”). IoT devices are often left with default or weak passwords which are easy to exploit. Many users will often leave the device to its default settings or an easy password for their device. If the attacker is able to get through because of the weak password, they will now have access to the device along with using for purposes such as the botnet.
All of these problems play big roles in all different aspects of cybersecurity. As IoT devices are implemented into many different industries, cities, and homes. IoT devices are crucial in hospitals too, as devices such as heart rate monitors are an IoT device. These heart rate monitors are important for patient care and can carry the same vulnerabilities for attackers to exploit as other IoT devices. “The scale of IoT application services is large, covers different domains” and therefore security of these devices needs to be taken seriously for all industries (Polak). Security cameras in cities are also IoT devices that cybersecurity faces challenges to secure, as the world is innovating with the use of IoT devices the upkeep for security of these devices is more crucial.
Problems with IoT security are not all technical though. As innovation of IoT devices continues to grow, they are constantly fighting against many other disciplines to be able to secure IoT devices. Companies may think that security is “based on expensive schemes like encryption and signing”, so companies choose to cut on security to keep cost low (Schiller). Cybersecurity professionals also have to fight usability vs. security when it comes to IoT. Customers want devices that are easy to use and quick to set up, this raises problems as “these requirements are in contradiction to security measures” (Schiller). Cybersecurity professionals are in a constant battle between security and usability, cost and security. These battles complicate IoT security and help show light that other disciplines are needed to properly secure these devices. In the following paragraphs I have other disciplines that also play a role in understanding the problem of securing these devices and how they can also help with security.
Psychology
Psychology also plays a role in trying to fix IoT security. A challenge in IoT security is not only the technical vulnerabilities. Human behaviors are another way for IoT devices to be exploited. When a user is buying an IoT device, they are most likely not thinking about security of the device. Users are more trusting in the device they have bought from the store and ready to set it up. The users may not have the “understanding of the number and type of internet-related risks to which he or she might be exposing him or herself” (Chong). The main solution that psychology has come to is to equip the users with the knowledge needed. For industries they can put their employees through training to give them the knowledge needed to make sure they know the practices to ensure their devices are secure in the workplace. In households a solution can be “a prompt on a smart baby monitor can occasionally remind the user that changing the password” is a smart security practice (Chong).
Understanding user behavior is a very important part in IoT security. For example, someone who interacts with IoT devices in a corporate setting will interact with the device differently than those that use it at home. Users will “differ in their overall motivation and their general enthusiasm toward” their device and the security of it (Chong). It is important to equip users in all different environments with knowledge of IoT security risks and practices to properly secure themselves. A study found that “users tend to think that their computer systems are secure by default”, leading them to leave settings at default when they should be changing them (Chong). A point of view on this are passwords, leaving a default password is a big security risk that comes from user behavior. Not only is changing the password crucial in security, but it is also important to make sure users are aware that using a strong password is just as important. Using a weak password can be easy to crack and does not help improve security in the device.
Another way to look at user behavior is available training, those who work at companies may be required to go through training for proper security practices. Home users on the other hand will not have access to that training and many may not even think or want to do anything about security knowledge. The importance of understanding this user behavior is crucial, as users may be discouraged because they think it is hard and requires too many steps. Understanding this can help show that “implementing concise and easy-to-perform security instructions and minimizing user effort” can be an effective way to bring users to use good security practices (Chong). Another way to help home users practice security is by warning them of the risks, making sure they know of the problems that can come if their device is exploited can encourage users to take the security practices more seriously.
Political Science
Political Science is another discipline that looks at the issue of IoT security. The main problem in governing IoT devices is the rate at which these devices are developing. With the rapid pace of IoT development, companies “do not take the time to develop sophisticated security measures and instead apply quick security fixes if necessary” leading to big vulnerabilities from the start (Schiller). Companies instead focus on quickly getting devices onto the market that are easy to set up and affordable, neglecting security practices. Governments can instead step in IoTs growing development to help provide better security being implemented into the devices. With governance being applied to IoT devices it can “shape and encourage the adoption of standards ensuring proper security” (Lawrence). Through government regulations they can set standards and help ensure that companies are not cutting costs on security to push more devices into the market. This governance however requires cooperation globally. As IoT devices are sold globally, this is a problem that “will call for state level regulation, international coordination” as IoT security is a problem for the world (Carr).
Another way political science can help look at IoT device security is through monitoring other industries uses of IoT devices. IoT devices are not only in the technology field and can be used in other industries that have no knowledge of the problems that can be brought through IoT devices. Toy manufacturers also can use IoT devices within their products and market it off for kids. These toy manufacturers are then in turn producing toys with vulnerabilities for hackers to exploit, they “have extensive knowledge about the safe use of plastics” but they also lack the knowledge of “risks of recording devices in different settings, and the implications of national surveillance regimes” (Carr). A toy produced by a company contained a speaker with Bluetooth capabilities, this toy was later “found to have a security vulnerability that allowed third parties to listen to the children” without being detected allowing them spy on families through a kids toy (Carr).
This usage of IoT devices brings a set of problems that require government regulations to help solve. With proper regulation, guidelines can be brought in to help other industries make sure they are also aware of the possible problems that may come with their products if they implement IoT devices into them. It helps make sure that other industries such as toy manufacturers are taking another step further outside of plastic safety concerns with the new generation of toys using IoT devices. Regulations can also help make sure that before an IoT device makes its way to another industry that may have no knowledge on security of the devices, that the company producing the device is taking proper measures to ensure security.
Conclusion
IoT security is a complex issue that requires the involvement of multiple disciplines. Cybersecurity is needed to help secure the technical aspects of the IoT problem such as encryption and authentication. Psychology is needed to understand the human factors behind bad user practices for IoT security. Political Science is needed to look into regulations to help make sure that companies are pushing for secure devices instead of rushing their devices into the markets. All of these are needed to make sure that IoT devices are secure, a device can have the best technical defenses, but bad human factors can bypass all technical defenses.
References
Abdullah, A., & et al. “CyberSecurity: A Review of Internet of Things (IoT) Security Issues, Challenges, and Techniques” IEEE Xplore, 2019. https://ieeexplore.ieee.org/document/8769560
Carr, M., Lesniewska, F. “Internet of Things, Cybersecurity and Governing Wicked Problems: Learning from Climate Change Governance” Sage Journals. 17 Sept. 2020. https://journals.sagepub.com/doi/10.1177/0047117820948247
Chong, I., et al. “Human Factors in The Privacy and Security of The Internet of Things” SageJournals, 2 May. 2018. https://faculty.ist.psu.edu/axx29/publications/eid_19.pdf
Polat, G. “Security Issues in IoT: Challenges and Countermeasures” ISACA, 2 January. 2019. https://www.isaca.org/resources/isaca-journal/issues/2019/volume-1/security-issues-in-iot-challenges-and-countermeasures?gad_source=1&gad_campaignid=20381363240&gbraid=0AAAAAD_A9K8_v25NXaxTMbvR3njTBFDLO&gclid=EAIaIQobChMIk_Pb88inkQMVWVpHAR2_4i13EAAYAiAAEgL0DPD_BwE
Schiller, E., & et al. “Landscape of IoT Security” Elsevier, May. 2022. https://www.sciencedirect.com/science/article/pii/S1574013722000120#d1e663
Trautman, L., et al. “Governance of The Internet of Things (IoT)” JSTOR, 2020. https://www.jstor.org/stable/pdf/27010026.pdf?casa_token=aacVrPXXEzUAAAAA:_ZvGBLtgPQRfusdbR30uFn8WIb9yj9mK-uhos551u28Hu51DbMk7W1GZEJE24M6Xz1ZOJhcptNDB3ImPJLZtMsUTdlWwbC3w09KFrT2jobRRMr1kGg
“What is the Mirai Botnet?” CloudFlare, https://www.cloudflare.com/learning/ddos/glossary/mirai-botnet/