OVERVIEW

The Internet of Things – A “Security Time Bomb”

With the arrival of the IoT and billions of new Internet-connected machines, appliances, sensors, “things,” robots, and devices, wirelessly trafficking data to and from the Cloud where it is stored, cybersecurity has become a near impossibility, and the threat of devastating attacks is on the rise. In fact, according to the The World Economic Forum’s Global Risks Report 2018, cyber security is the third greatest global risk of 2018 topped only by natural disasters and extreme weather conditions.

ZDNet reports, “The economic costs of a large cyber-attack could be as large as the impact of a major natural disaster.

An Economic Times article titled, All of us are sitting on a ticking time bomb called the internet explains: 

“The more connected the world gets, the more vulnerable it becomes.” 

Referring to the Global Risk Reports 2018, reporter Tom Ball writes:

“The report warns that the world is on the brink of an exponential increase in attack targets, driven by the growth of the IoT market.

According to the Wall Street Journal, the FBI sent a note to private companies warning,

“The exploitation of the ‘Internet of Things’ (IoT) to conduct small-to-large scale attacks on the private industry will very likely continue.”

Cyber vulnerability cannot be detected until there is an actual attack. First an IoT machine or “thing” is built. Then (potentially) comes a cyber attack. And last, the “patch,” aka, the fix. Due to the ingenuity of hackers, the ever-evolving nature of digital technology, and the fact that many systems cannot be shut down to enable a patch, we will at best always be in a reactive stance – responding as breaches occur.  As explained by reporter Danny Palmer in a recent article about IoT security,

Retrofitting updates via the use of patches might work for a PC, a laptop or even a smartphone, but there are huge swathes of devices — and even whole internet-connected industrial or urban facilities — for which being shutdown in order to install and update is impossible,

Beyond the increase in hacking enabled by the IoT, the nature of the attacks has also changed. Before the IoT, attacks involved stolen data, such as personal identifying information, credit cards, and so forth. In an IoT world, attacks become far more impactful and devastating. Bruce Schneier explains,

With the advent of the Internet of Things and cyber-physical systems in general, we’ve given the Internet hands and feet: the ability to directly affect the physical world. What used to be attacks against data and information have become attacks against flesh, steel, and concrete.” 

Schneier goes on:

“Today’s threats include hackers crashing airplanes by hacking into computer networks, and remotely disabling cars, either when they’re turned off and parked or while they’re speeding down the highway. We’re worried about manipulated counts from electronic voting machines, frozen water pipes through hacked thermostats, and remote murder through hacked medical devices. The possibilities are pretty literally endless. The Internet of Things will allow for attacks we can’t even imagine.”

A rather innovative form of domestic abuse is becoming more common that utilizes IoT “things” as tools to torment.their victims,

For more about how cyber physical systems of the IoT will likely cause real world cyber attacks, please see The Internet of Things Will Cause the First Ever Large Scale Internet disaster.

As things stand now in the IoT-wild west – our 21st century gold rush – no one is ensuring that our software-embedded technologies are secure. Start-up companies lack resources, motivation, or personnel to properly secure software-embedded technologies. And our government is asleep at the wheel with regard to regulating cyber security.

Following are some reasons for these gaping holes in IoT cybersecurity.