Internet of Things (IoT)

Best Practices in IoT

Internet of Things is rapidly growing and its growth rate has been improving in the last decade. With the introduction of more IoT devices, there has been increasing concerns regarding security and privacy issues included with the usage of these devices. One of the main appeals of IoT is the fact that many devices are connected together which can lead to interoperability of these devices. However, interoperability is a double-edged sword as sharing information between devices can result in more exposure.

Currently, Internet of Things (IoT) security appears to depend on the kindness of strangers, especially as a single vulnerable device in an IoT network can lead to loss of information from other devices as well. In response, a range of organizations have published best practices for producing secure IoT devices. These organizations range from governmental organizations (like Federal Trade Commission) to international organizations (like Online Trust Alliance.)

Traditional security threats are still relevant in the Internet of Things (IoT). Yet traditional security threat models are inadequate for technologies that act upon our homes, families, and even pets. One response to the inadequacy of traditional threat models has been the creation of IoT best practices. These best practices have been created to answer the traditional and modern security threats relating to both computer systems in general and threats relating to IoT devices specifically. In our IoT project, we look to evaluate these best practices and see how effective they are in regards to minimizing vulnerabilities in the current IoT world.

To evaluate the efficacy of these best practices, we selected two very different hubs: and Samsung. One system is arguably the most closed hub on the market, designed to interact only with its own sensors. The second system is highly interoperable, working with Amazon, Apple, and Android devices. The targeted markets are consequently very different, with targeting specific vulnerable populations and Samsung offering interoperability to all. The hubs are organizationally different, with one system from a small new entrant and one from a large established manufacturer. Upon penetration testing, we found both had vulnerabilities. Unfortunately these vulnerabilities are acute for each hub: the hub targeting sensitive populations is subject to data manipulation, and the one with the broadest interoperability is at risk for botnet enrollment.

Ideally, best practices should address the requirements necessary to provide security and privacy in IoT. Some of these practices are purely technical, part of the construction and design of the devices. However, some requirements are inherently organizational, including the disclosure of vulnerabilities. We try out evaluate all of these practices where possible.

Our first contribution is to provide case studies of security issues in two very different consumer IoT hubs. We enumerate a union of the best practices from the guidelines that existed at the time of the analysis, illustrating in which cases they would have mitigated or prevented the vulnerabilities we identified. We illustrate that the extant best practices, if properly used, could have mitigated some of the vulnerabilities. We note where a simple Boolean check box is an inadequate measure. We also mention our disclosure efforts and how the companies responded and reacted to the disclosures.