This report explores security concerns involving Internet of Things (IoT) devices and the cybersecurity risks they can create. It discusses examples of IoT-related threats, including the Mirai botnet, and examines how human behavior, regulations, and international cooperation can affect IoT security. This artifact demonstrates my ability to research a cybersecurity topic from multiple disciplinary perspectives. Through this report, I demonstrate that cybersecurity is not only a technical concern but also requires insights from other disciplines to better understand complex problems.<\/p>\n\n\n\n
The Internet of Things is a growing aspect of technology quickly making its way into many lives.\u00a0 As IoT devices grow they are finding their way to normal consumers, industrial markets, and commercial markets.\u00a0 Some examples of IoT appliances are smart watches, smart speakers, sensors on machinery, tracking devices for fleet vehicles, and devices used in healthcare.\u00a0 The growth of IoT has been revolutionary, but it also has come with concerns regarding the security of the devices.\u00a0 The security of IoT devices has come with problems such as weak authentication and passwords, lack of encryption on data, and containing vulnerable software.\u00a0 While many think this only concerns cybersecurity, it is a problem that also requires views from other disciplines to help solve the problem.\u00a0 The combination of these disciplines helps show the many sides of the problem to gather a full understanding of IoT security and how to solve the problem.<\/p>\n\n\n\n
Cybersecurity, one of the main disciplines in IoT security, looks to networks and the protection of data and devices on the network. From the cybersecurity view of IoT security, \u201cthese devices cause many vulnerabilities that appear as a fertile ground for cyber threats\u201d (Abdullah). Exploits on these devices can be based on hardware, software, or network limitations on IoT devices. These limitations open up easy vulnerabilities for bad actors to exploit. One of the vulnerabilities related to IoT devices is the weak encryption, many have criticized the encryption on IoT devices and cybersecurity looks to add stronger encryption for IoT devices.<\/p>\n\n\n\n
Another technical challenge that comes up is that most IoT devices are operating 24\/7. This makes IoT devices likely targets for botnets, because of the availability of these devices, bad actors may be encouraged to use these devices in their botnets to perform bigger attacks. An example of this was the Mirai botnet, which attacked sites such as Twitter, Reddit, and Netflix \u201cresulting in unavailability of the web sites\u201d for hours (Schiller). These botnets can consist of thousands of IoT devices that were highjacked by bad actors for often bad purposes, such as launching the bots to a network to overload traffic causing the system to go down for a period of time. These botnets can be used for other purposes though, such as \u201csend spam email, steal credit card information\u201d and the list goes on, as long as the bad actor has control of the device and it has connection to the internet it can be used negatively (\u201cCloudfare\u201d).<\/p>\n\n\n\n
IoT security has another challenge, weak passwords. Weak passwords were also how the Mirai botnet came to be, it searched for IoT devices with a default password where it was \u201cable to log into the device and infect it\u201d (\u201cCloudfare\u201d). IoT devices are often left with default or weak passwords which are easy to exploit. Many users will often leave the device to its default settings or an easy password for their device. If the attacker is able to get through because of the weak password, they will now have access to the device along with using for purposes such as the botnet.<\/p>\n\n\n\n
All of these problems play big roles in all different aspects of cybersecurity. As IoT devices are implemented into many different industries, cities, and homes. IoT devices are crucial in hospitals too, as devices such as heart rate monitors are an IoT device. These heart rate monitors are important for patient care and can carry the same vulnerabilities for attackers to exploit as other IoT devices. \u201cThe scale of IoT application services is large, covers different domains\u201d and therefore security of these devices needs to be taken seriously for all industries (Polak). Security cameras in cities are also IoT devices that cybersecurity faces challenges to secure, as the world is innovating with the use of IoT devices the upkeep for security of these devices is more crucial.<\/p>\n\n\n\n
Problems with IoT security are not all technical though. As innovation of IoT devices continues to grow, they are constantly fighting against many other disciplines to be able to secure IoT devices. Companies may think that security is \u201cbased on expensive schemes like encryption and signing\u201d, so companies choose to cut on security to keep cost low (Schiller). Cybersecurity professionals also have to fight usability vs. security when it comes to IoT. Customers want devices that are easy to use and quick to set up, this raises problems as \u201cthese requirements are in contradiction to security measures\u201d (Schiller). Cybersecurity professionals are in a constant battle between security and usability, cost and security. These battles complicate IoT security and help show light that other disciplines are needed to properly secure these devices. In the following paragraphs I have other disciplines that also play a role in understanding the problem of securing these devices and how they can also help with security.<\/p>\n\n\n\n
\u00a0Psychology also plays a role in trying to fix IoT security.\u00a0 A challenge in IoT security is not only the technical vulnerabilities.\u00a0 Human behaviors are another way for IoT devices to be exploited.\u00a0 When a user is buying an IoT device, they are most likely not thinking about security of the device.\u00a0 Users are more trusting in the device they have bought from the store and ready to set it up.\u00a0 The users may not have the \u201cunderstanding of the number and type of internet-related risks to which he or she might be exposing him or herself\u201d (Chong).\u00a0 The main solution that psychology has come to is to equip the users with the knowledge needed.\u00a0 For industries they can put their employees through training to give them the knowledge needed to make sure they know the practices to ensure their devices are secure in the workplace.\u00a0 In households a solution can be \u201ca prompt on a smart baby monitor can occasionally remind the user that changing the password\u201d is a smart security practice (Chong).<\/p>\n\n\n\n
Understanding user behavior is a very important part in IoT security. For example, someone who interacts with IoT devices in a corporate setting will interact with the device differently than those that use it at home. Users will \u201cdiffer in their overall motivation and their general enthusiasm toward\u201d their device and the security of it (Chong). It is important to equip users in all different environments with knowledge of IoT security risks and practices to properly secure themselves. A study found that \u201cusers tend to think that their computer systems are secure by default\u201d, leading them to leave settings at default when they should be changing them (Chong). A point of view on this are passwords, leaving a default password is a big security risk that comes from user behavior. Not only is changing the password crucial in security, but it is also important to make sure users are aware that using a strong password is just as important. Using a weak password can be easy to crack and does not help improve security in the device.<\/p>\n\n\n\n
Another way to look at user behavior is available training, those who work at companies may be required to go through training for proper security practices. Home users on the other hand will not have access to that training and many may not even think or want to do anything about security knowledge. The importance of understanding this user behavior is crucial, as users may be discouraged because they think it is hard and requires too many steps. Understanding this can help show that \u201cimplementing concise and easy-to-perform security instructions and minimizing user effort\u201d can be an effective way to bring users to use good security practices (Chong). Another way to help home users practice security is by warning them of the risks, making sure they know of the problems that can come if their device is exploited can encourage users to take the security practices more seriously.<\/p>\n\n\n\n
Political Science is another discipline that looks at the issue of IoT security.\u00a0 The main problem in governing IoT devices is the rate at which these devices are developing.\u00a0 With the rapid pace of IoT development, companies \u201cdo not take the time to develop sophisticated security measures and instead apply quick security fixes if necessary\u201d leading to big vulnerabilities from the start (Schiller).\u00a0 Companies instead focus on quickly getting devices onto the market that are easy to set up and affordable, neglecting security practices.\u00a0 Governments can instead step in IoTs growing development to help provide better security being implemented into the devices.\u00a0 With governance being applied to IoT devices it can \u201cshape and encourage the adoption of standards ensuring proper security\u201d (Lawrence).\u00a0 Through government regulations they can set standards and help ensure that companies are not cutting costs on security to push more devices into the market.\u00a0 This governance however requires cooperation globally.\u00a0 As IoT devices are sold globally, this is a problem that \u201cwill call for state level regulation, international coordination\u201d as IoT security is a problem for the world (Carr).<\/p>\n\n\n\n
Another way political science can help look at IoT device security is through monitoring other industries uses of IoT devices. IoT devices are not only in the technology field and can be used in other industries that have no knowledge of the problems that can be brought through IoT devices. Toy manufacturers also can use IoT devices within their products and market it off for kids. These toy manufacturers are then in turn producing toys with vulnerabilities for hackers to exploit, they \u201chave extensive knowledge about the safe use of plastics\u201d but they also lack the knowledge of \u201crisks of recording devices in different settings, and the implications of national surveillance regimes\u201d (Carr). A toy produced by a company contained a speaker with Bluetooth capabilities, this toy was later \u201cfound to have a security vulnerability that allowed third parties to listen to the children\u201d without being detected allowing them spy on families through a kids toy (Carr).<\/p>\n\n\n\n
This usage of IoT devices brings a set of problems that require government regulations to help solve. With proper regulation, guidelines can be brought in to help other industries make sure they are also aware of the possible problems that may come with their products if they implement IoT devices into them. It helps make sure that other industries such as toy manufacturers are taking another step further outside of plastic safety concerns with the new generation of toys using IoT devices. Regulations can also help make sure that before an IoT device makes its way to another industry that may have no knowledge on security of the devices, that the company producing the device is taking proper measures to ensure security.<\/p>\n\n\n\n
Conclusion<\/strong><\/p>\n\n\n\n IoT security is a complex issue that requires the involvement of multiple disciplines.\u00a0 Cybersecurity is needed to help secure the technical aspects of the IoT problem such as encryption and authentication.\u00a0 Psychology is needed to understand the human factors behind bad user practices for IoT security.\u00a0 Political Science is needed to look into regulations to help make sure that companies are pushing for secure devices instead of rushing their devices into the markets.\u00a0 All of these are needed to make sure that IoT devices are secure, a device can have the best technical defenses, but bad human factors can bypass all technical defenses.<\/p>\n\n\n\n References<\/p>\n\n\n\n Abdullah, A., & et al. \u201cCyberSecurity: A Review of Internet of Things (IoT) Security Issues, Challenges, and Techniques\u201d IEEE Xplore<\/em>, 2019. https:\/\/ieeexplore.ieee.org\/document\/8769560<\/a><\/p>\n\n\n\n Carr, M., Lesniewska, F. \u201cInternet of Things, Cybersecurity and Governing Wicked Problems: Learning from Climate Change Governance\u201d Sage Journals<\/em>. 17 Sept. 2020. https:\/\/journals.sagepub.com\/doi\/10.1177\/0047117820948247<\/a><\/p>\n\n\n\n Chong, I., et al. \u201cHuman Factors in The Privacy and Security of The Internet of Things\u201d SageJournals<\/em>, 2 May. 2018. https:\/\/faculty.ist.psu.edu\/axx29\/publications\/eid_19.pdf<\/a><\/p>\n\n\n\n Polat, G. \u201cSecurity Issues in IoT: Challenges and Countermeasures\u201d ISACA<\/em>, 2 January. 2019. https:\/\/www.isaca.org\/resources\/isaca-journal\/issues\/2019\/volume-1\/security-issues-in-iot-challenges-and-countermeasures?gad_source=1&gad_campaignid=20381363240&gbraid=0AAAAAD_A9K8_v25NXaxTMbvR3njTBFDLO&gclid=EAIaIQobChMIk_Pb88inkQMVWVpHAR2_4i13EAAYAiAAEgL0DPD_BwE<\/a><\/p>\n\n\n\n Schiller, E., & et al. \u201cLandscape of IoT Security\u201d Elsevier<\/em>, May. 2022. https:\/\/www.sciencedirect.com\/science\/article\/pii\/S1574013722000120#d1e663<\/a><\/p>\n\n\n\n Trautman, L., et al. \u201cGovernance of The Internet of Things (IoT)\u201d JSTOR<\/em>, 2020. https:\/\/www.jstor.org\/stable\/pdf\/27010026.pdf?casa_token=aacVrPXXEzUAAAAA:_ZvGBLtgPQRfusdbR30uFn8WIb9yj9mK-uhos551u28Hu51DbMk7W1GZEJE24M6Xz1ZOJhcptNDB3ImPJLZtMsUTdlWwbC3w09KFrT2jobRRMr1kGg<\/a><\/p>\n\n\n\n