It seems that everywhere we look, more home devices and appliances are receiving smart functionality. Today, consumers can buy refrigerators that will email them when certain items run low, smoke alarms that will text them when they detect smoke and cameras that will stream videos of pets, or even intruders, as they move from room to room.
The conveniences of a smart home are undeniable. But each amenity we add to our home comes at a cost – and too often that cost is paid in terms of security. Each smart device we add to a home is equivalent to adding another door or window. Without the proper embedded security within the device, the lock is nonexistent.
It’s so easy to connect things to the internet these days, but the harsh reality is that smart devices can be dumb when it comes to security. Anyone with a little more-than-basic understanding of computers can gain access to a home network and any devices connected to it.
Symantec recently reviewed the security controls of 50 different connected devices, including many home devices like smart thermostats, locks, light bulbs, smoke detectors, energy management devices, and smart hubs. The results were sobering. The reviewers found that not only is security lacking across-the-board, but in some cases security was completely nonexistent. One out of five devices did not encrypt its communications and many did not lock out attackers after a certain number of password attempts. This should be a wake-up call to the industry and is a harbinger of government action.
The FTC just announced that they will have further oversight of the industry by introducing the creation of a new Bureau of Consumer Protection division called the Office of Technology Research and Investigation. This group will be tasked to oversee everything smart device related, from Apple Pay to Nest.
This is a welcome step – but let’s be honest, it’s a finger in the dam. The speed of oversight is no match for the velocity at which new devices are launched – and the speed at which security flaws are identified and exploited.
The smart home security problem needs to be solved at the device and system level. Companies need to design devices and cloud architectures with security in mind from the start – not as an afterthought. It isn’t enough to have a security consultant offer insight at the end of the design process.
Instead, security experts need to have the same credibility and respect that the industry gives UX gurus and software developers. Security teams need to be given a full seat at the table throughout the entire design and build process. Security should not be seen as a cost center – it should be seen as a core function of the business!
After all, what is the real net-benefit of a refrigerator that can text you when you run low on milk if it’s also the gateway that allows a hacker entrance into your home network and access to your entire digital life?
The amazing thing about this is that fixing the problem is easy when the right attention is devoted by the right people. While some companies will have to redesign some of their systems to be more secure, these are changes that can happen in months rather than years. If the smart device industry woke up, took this threat seriously and adopted industry-wide encryption standards, this might not even be an issue a year from now. Without such steps, we will see exponential growth in breeches, hacks and attacks on personal networks through seemingly “smart” devices.
We’ve seen this movie before – the same security inadequacies we see in the home are pervasive in almost every connected device. The future of the smart home needs to be about more than simply connecting devices to the internet. After all, what is the point of added convenience and connectivity if it comes at the cost of security?
Security should not be an afterthought of smart device design, but the foundation.
Edited by
Ken Briodagh
