Author: Elgin Green, IT Team Leader

IoT (Internet of Things)

“Augmenting the human experience with a connected world”[i]

“Oh! Sorry I didn’t see you sitting there. It’s my morning break here at work, so I was checking a few things at home. Making sure that I locked the front door and checking to see if we had eggs in the fridge. Looks good. And the dog’s behaving.

So, do you remember back in 2019 when IoT was new and security was sketchy? I figured I didn’t have a lot to lose by installing that smart front door lock. After all, it was nice for the door to unlock when I pulled into the driveway, and then have it auto-lock when I left for work. I could even unlock it for my daughter who dropped by unannounced from out of town. Nice.

At that time, some people weren’t comfortable with the level of cybersecurity in IoT, so they stayed away. Others…they did their homework and only went with devices that were designed from the ground up for security. Smart.”

What’s Involved?

IoT (Internet of Things): “the interconnection via the Internet of computing devices embedded in everyday objects, enabling them to send and receive data.” So, many “smart” things are in this category: locks, thermostats, lights, alarms, toys, automobiles, garage doors, sprinklers, IP cameras, refrigerators, or your home DVR. Convenience and utility.

IoT can make your home more secure from burglars by automatically locking your front door when you leave, alert you to someone at your front or back door, make your coffee, turn your lights on and off, etc., etc. What’s not to like, right?

This transformational technology is growing geometrically and is poised for an explosion. IHS Market (a London-based global information provider) predicts that by 2025 there will be 73 billion IoT devices installed[ii]. That’s more than 9 per person on earth! With all these devices connected to the Internet, the bad guys are constantly attempting to gain access in order to steal information and steal your stuff.

Are they secure?

With all these advantages, the question becomes what is the risk of installing a smart device? It turns out that there is a lot NOT to like, IF you are not careful. Alas, most IoT manufacturers have no program for disclosing and reporting security issues. A December 2018 report explains that “90% Of Consumer IoT Vendors Don’t Let Researchers Report Vulnerabilities”[iii]. That could mean that if you are not technically inclined or are not willing to do the homework, you may want to wait until IoT technology is more mature and secure.

Here are some of the issues and possible consequences:

Issue Possible Consequence
No security updates Device could be vulnerable
Weak credentials that can’t be changed Device is vulnerable
A hacked IoT device Allows access to your other accounts on your network, identify theft
Remote (unattended!) enablement of stoves, cookers, microwaves Safety hazard
Self-driving car vulnerabilities Theft, safety concern

“As an example, an IoT thermostat very likely communicates to a cloud server to provide updates and to control the device remotely,” Jett [Justin Jett, director of audit and compliance for Plixer] says. “If the IoT security is robust, but the cloud security is significantly lacking, the entire system is vulnerable.”[iv]

What can you do?

For those who want to enjoy the benefits of current IoT tech, this may be a good time to do a little online research and get a smart lock for your front door or smart LED lights that turn on at sundown and can be controlled from anywhere in the world.

If you decide to take a step into the Internet of Things, remember that your smart device will be part of your local network. So, here’s what you should do.

  • Choose your IoT devices not just based on convenience, but also on security.
    • Smart locks are very convenient, and they are as secure as traditional locks IF well designed and supported.
    • Make sure the manufacturer is actively supporting the device.
    • Keep a “good ol’ fashion” key handy when the keyless remote entry fails.
  • Insist on strong security and check your devices’ configurations.
  • Keep your computer and smart phones updated; they usually share the same network at your home.
  • Install computer virus and malware protection
  • Use multifactor authentication when possible.
  • Don’t use public Wi-Fi without VPN.
  • Only use known devices. E.g., if you don’t know where a USB thumb drive has been, leave it alone.

Here’s an excellent consumer guide for smart home devices, developed by the UK government.

The Future

California has enacted the first law covering IoT and this may drive future federal regulations. “The short IoT bill requires IoT manufactures to equip devices with “reasonable” security measures, appropriate to the function of the devices and to the information they collect or transmit.”[v] The move is toward more security and accountability, which is good for the industry and for consumers…like you.

Spectrum IT

The IT Team at Spectrum works behind the scenes to ensure that your investment and personal information is kept safe and secure. We also strive to make sure that Spectrum’s other teams have access to the information they need, enabling them to make the best timely decisions possible for you.

[i] “The next chapter of IoT is just beginning as we see a shift from digitally enabling the physical to automating and augmenting the human experience with a connected world,” says Carrie MacGillivray, IDC. https://www.idc.com/getdoc.jsp?containerId=US44390618

[ii] IHS Markit, The top transformative technologies to watch this year, 2018 (PDF, 16 pp., no opt-in)

https://www.marketwatch.com/story/7-ways-to-keep-your-smart-home-from-being-hacked-2016-10-17

[iii] https://www.forbes.com/sites/daveywinder/2018/12/13/the-silence-of-the-brands-90-of-consumer-iot-vendors-dont-let-researchers-report-vulnerabilities/#4f60977d9c88

[iv] https://www.scmagazine.com/home/security-news/lightly-secured-cloud-with-a-chance-of-iot-attacks/

[v] https://www.scmagazine.com/home/opinions/californias-new-iot-security-law-is-not-nearly-enough-we-need-a-gdpr-for-iotnow/

Give me your Credit Card

Most of us do some shopping online. Some of us a lot! So how can we stay safe with using our credit card for all those purchases? Here are a few tips that go a long way toward protecting your assets while taking care of business:

Only shop at sites you know and trust. Most of the problems come from sites that are just a little off the beaten path. That “Unbeatable Deal!” might be a trick to steal your credit card info. But, large well-known sites are seldom a problem.

Credit is safer than Debit. Credit cards have some built-in protection like a limit on your liability. It can be as low as $50 or even zero-liability. Debit cards do not have this same protection.

Secure sites. A secure site encrypts your credit information so it can’t be stolen. Look in the website address for the extra “s” near the beginning. “https”. This means that the site is secure. It doesn’t mean that your 100% safe, but it helps a lot.

PayPal. Is PayPal safe? Absolutely. It may be safer than your credit card because it has powerful fraud and consumer protections in place. If you use PayPal, it’s best to link it to your credit card, not your bank account. This way you’ll also gain the extra layer of protection that your credit card provides. Double protection!

Protect your social. Never give out your social security number for a purchase. It’s never needed for an online transaction. If they ask for it or for more info than is needed for the transaction, cancel the purchase and run.

Review your transactions regularly. Small unfamiliar charges that show up on your bank statement could be a test from a hacker, and can give them the green light to larger fraudulent charges.

Stay Private. Don’t do online transactions on public computers or Wi-Fi. Your credentials could be saved or hacked. This could lead to identity theft or fraudulent credit card charges.

Spectrum Financial, Inc 2019