1. Internet-of-somewhat-dubious-Things
What exactly is the Internet-of-Things (looking around my house)
Cable modem, router, switch
3 Apple Macs, 2 PCs
iPhones (4), iPads (6), Android phone, iPod
Smart televisions (2), multimedia systems (2), gaming controller (1)
Home security devices – webcams (2), burglar alarm, smoke and fire sensors
Home automation – lighting, temperature controls, entry systems, appliance monitoring
Numerous decommissioned devices

2. The myth of ‘low cost’ devices
Often claimed that it’s not economical for vendors to maintain low-cost devices
My PCs and router was cheaper than my smart televisions and cameras
Windows (7 and above) has regular updates
My router has periodic firmware and operating system
Smart televisions got a couple of updates and nothing after 1 year
Cameras had regular updates for 2 years – then nothing since
So presumably it’s possible to provide ongoing support with sufficient critical mass. How do we encourage/mandate that?

3. OTA IoT Security & Privacy Trust Framework
Online Trust Alliance – an Internet Society Initiative
Has developed IoT Trust Framework with 37 principles to secure IoT devices and their data
Security – ensure devices use cryptographic protocols by default, only open physical and virtual ports and services that are required, regular monitoring of security settings, verifiable patches,
User Access & Credentials – strong authentication, storing of credentials, and anti-brute forcing measures
Privacy, Disclosure & Transparency – what data is being transferred, only collecting data with affirmative user support, disclose end-of-life security and patch support
Notifications – sending authenticated messages to users