Internet-of-somewhat-dubious-Things What exactly is the Internet-of-Things (looking around my house) Cable modem, router, switch 3 Apple Macs, 2 PCs iPhones (4), iPads (6), Android phone, iPod Smart televisions (2), multimedia systems (2), gaming controller (1) Home security devices – webcams (2), burglar alarm, smoke and fire sensors Home automation – lighting, temperature controls, entry systems, appliance monitoring Numerous decommissioned devices

The myth of ‘low cost’ devices Often claimed that it’s not economical for vendors to maintain low-cost devices My PCs and router was cheaper than my smart televisions and cameras Windows (7 and above) has regular updates My router has periodic firmware and operating system Smart televisions got a couple of updates and nothing after 1 year Cameras had regular updates for 2 years – then nothing since So presumably it’s possible to provide ongoing support with sufficient critical mass. How do we encourage/mandate that?

OTA IoT Security & Privacy Trust Framework Online Trust Alliance – an Internet Society Initiative Has developed IoT Trust Framework with 37 principles to secure IoT devices and their data Security – ensure devices use cryptographic protocols by default, only open physical and virtual ports and services that are required, regular monitoring of security settings, verifiable patches, User Access & Credentials – strong authentication, storing of credentials, and anti-brute forcing measures Privacy, Disclosure & Transparency – what data is being transferred, only collecting data with affirmative user support, disclose end-of-life security and patch support Notifications – sending authenticated messages to users https://otalliance.org/system/files/files/initiative/documents/iot_trust_framework2.1.pdf