Security of all Things Internet

Security expert, Bruce Schneier, did this podcast which can be summed up in two words: interesting throughout. The term Internet of Things (IoT) refers to objects around us that “talk” via the Internet. While this opens up opportunities (your fridge tells Alexa that the milk is running out, who then tells you, and you then tell Alexa to order some milk), it opens up security risks all around.

The root cause for these security risks, explains Schneier, is as simple as it may sound horrifying today: the Internet was never designed with security in mind! Because it was designed for mostly inconsequential usage, and only by academics at that. In other words, it was a conscious choice to not care about security. And boy, have those chickens come home to roost today.

Ok, but why can’t security be incorporated today? Aha, there are many reasons:

1)      Complex systems are inherently hard to secure. Your smartphone is a highly complex device. And supply chain security is very hard, since it involves too many actors in the chain. See my earlier blog on that.

2)     We love things that are free. But software that addresses security vulnerabilities costs money.

3)     Even if you cared, there is no data available on which devices are more secure. In an age where people file reviews on everything else under the sun, what does that say about us?

4)     Software patches aren’t easy to roll onto existing devices. So most of the time, we get those patches only when we buy the next phone! Now think how long you keep the fridge and you get the number of fixes it never got. So we need a mechanism to roll out patches automatically. But everything runs on Android but Google doesn’t own the hardware, so good luck coordinating such things between Google and pretty much every manufacturer in the world.

5)     There is no financial penalty when data is breached. Think Marriott or Facebook. All they face is bad publicity, and public memory is short.

6)     Industries, like people, don’t learn from others. The PC industry learnt the importance of security in the 90’s. The IoT industry operates like that never happened. It may also be because most founders of IoT companies weren’t even born back then!

7)     And lastly, as software moves into already regulated industries like cars and medical devices, the regulations in those industries need to be updated. And you know who frames regulations, right? Yup, the government. So good luck updating anything owned and framed by the government.

Picture sound too gloomy? Schneier agrees, and fears things will change only when something catastrophic happens. Like somebody doing what the title of his book talks about: Click Here to Kill Everybody.