Less than half of firms able to detect IoT breaches, study shows

Addressing data issues

One of the biggest challenges to IoT security that is prompting calls for government intervention is the issue of data privacy (38%) and the collection of large amounts of data (34%).

Protecting an increasing amount of data is proving an issue, the survey shows, with only three in five (59%) of those using IoT and spending on IoT security admitting they encrypt all of their data.

Other Gemalto research shows consumers are not impressed with the efforts of the IoT industry, with 62% believing security needs to improve. When it comes to the biggest areas of concern, 54% fear a lack of privacy because of connected devices, followed closely by unauthorised parties such as hackers controlling devices (51%) and lack of control over personal data (50%).

While the industry awaits regulation, it is seeking ways to address the issues itself, according to Gemalto, with blockchain emerging as a potential technology solution.

Research shows adoption of blockchain has doubled from 9% to 19% in the past 12 months. Almost a quarter (23%) of respondents believe that blockchain technology would be an ideal solution to use for securing IoT devices, with 91% of organisations that do not currently use the technology saying they are likely to consider it in the future.

As blockchain technology finds its place in securing IoT devices, the survey shows that the majority of businesses (71%) are relying on encryption to protect their data, while password protection (66%) and two-factor authentication (38%) remain prominent.

According to Hart, businesses are clearly feeling the pressure of protecting the growing amount of data they collect and store. “While it’s positive they are attempting to address that by investing in more security, such as blockchain, they need direct guidance to ensure they’re not leaving themselves exposed. To get this, businesses need to be putting more pressure on the government to act,” he said.

In November 2018, IoT security researcher Ken Munro also called for government action at the EEMA ISSE 2018 cyber security conference in Brussels.

Like Hart, he said the UK Code of Practice is a good start, but Munro believes there is still a long way to go and he would like to see some basic regulation.

Speaking to Computer Weekly, Munro said a revised version of UK Code of Practice showed how existing legislation such as the EU’s General Data Protection Regulation (GDPR) could be brought to bear against poorly secured smart products.

“The CoP is a great start, but there is still more to be done,” he said. “I would like to see fresh primary legislation in the IoT arena in the UK, but this will take time. It would also be reasonable to let the CoP guidance ‘bed in’ with manufacturers. If they don’t start to change behaviour, that would be the time for regulation.”

Munro believes giving consumers the right to return vulnerable smart products for credit will create financial incentives for manufacturers to improve security, as will retailers committing to not stocking vulnerable smart tech, backed up by trading standards legislation. He would also like to see manufacturers delivering product security updates for the foreseeable life of the product.

“I think demonstrating security in a product will actually drive sales because if someone can buy a smart thermostat and know it is secure, that will increase sales in the market,” he said.