Security and Privacy Risks in IoT Technology

This report discusses the security and privacy risks associated with IoT technology. It covers topics such as data integrity, breach of private data, protecting data from corporations, limited encryption capabilities, handling privacy issues, and managing security updates.

Advance Topic in ICT
Security and Privacy are the principles of society most at risk with the internet of things? Do you
agree?

Table of Contents
Introduction...............................................................................................................................2
Internet of Things (IoT)..............................................................................................................2
Security and Privacy risks relating to IoT Technology................................................................3
Conclusion..................................................................................................................................5
References..................................................................................................................................6
Page 1

Introduction
With the advancement of technology, the role of information and communication
technology (ICT) has increased substantially in the lives of people across the globe.
Individuals rely on services such as social media sites, smartphones, and others to perform
their daily operations. The popularity of the internet of things (IoT) technology is growing
substantially worldwide. A large number of corporations manufactures the smart wearable
and smart home appliance, and these devices are available across the globe. The devices
enable users to continuously stay connected and communicate with other devices without
any difficulty (Gubbi et al., 2013). The IoT devices collect private data of users in order to
work properly; however, this raised various security and privacy concerns (Ziegeldorf,
Morchon, and Wehrle, 2014). Along with the popularity of IoT devices, the privacy attacks
on the personal data of users have increased substantially. It has become easier for cyber
criminals to collect the sensitive data of users through different IoT devices. This report will
focus on providing various arguments to support the statement that ‘security and privacy
are the principles of society most at risk with the internet of things’.
Internet of Things (IoT)
The IoT technology is referred to a system of interrelated computer devices, mechanical,
digital machines, objective, and others with unique identifiers (UIDs). These devices have
the ability to transfer data over a network with each other without the requirement of a
human-to-human or human-to-computer interaction (Lee and Lee, 2015). Based on this
interaction, the devices collect information and learn about the private data of the user
which enable them to provide seamless services to the clients. There is a wide range of IoT
devices which are produced by corporations across the globe which are used for
commercial, infrastructure, industrial and consumer spaces. Some examples of IoT devices
include smart home appliances, smart watch, smart cars, smart home hubs, and others. In
2018, there are more than 7 billion IoT devices produced by companies across the globe.
This number is to be expected to reach 21.5 billion by 2025 (Lueth, 2018). It shows that IoT
technology has the potential to affect a large number of people across the globe.
Page 2

Security and Privacy risks relating to IoT Technology
Since the IoT technology affects many people globally, it is important to evaluate the
security and privacy risks which parties face while using IoT technology. Security and privacy
are the key principles of society that are considered by companies while designing new
technologies or devices, however, these principles are the risk of breach with the popularity
of IoT technology. Following are various security and privacy risks which are associated with
IoT technology which affects its users.
 Ensuring data integrity
As discussed above, the number of IoT devices globally is expected to reach 21.5 billion by
2025, and currently, there are over 7 billion IoT devices produced by corporations (Lueth,
2018). These devices connect billions of people by establishing an interlinked ecosystem.
The IoT devices use sensors in order to collect the data of their uses and send it back to their
main server. Since all the IoT devices work closely, it increases the risk of a single
vulnerability which could have the potential to allow cyber criminals to manipulate the data
collected by these devices or making it misleading (Roman, Zhou and Lopez, 2013). Thus, the
private data collected by IoT devices relating to its users can be manipulated by its users
based on which it becomes easier for hackers to breach of privacy of users.
 Breach of private data
The IoT devices collect personal data of their users in order to work properly. For instance,
smart wearable devices collect information such as health data, private information,
passwords, location, and others. Smart home appliances have access to the entire home; for
instance, security cameras always record private moments of users in the house. All these
devices are connected to a single network which means that the security vulnerability of
one device can violate the security of the whole network (Miorandi et al., 2012). If hackers
get access to a single IoT device, then it becomes easier for them to collects the data from
other devices. There are various examples which already show the negative impact of the
popularity of IoT devices on the security and privacy of users. For instance, VTech
Electronics sold IoT kids’ toys which resulted in violating the privacy of their users.
Page 3

These devices were connected through the internet, and they exposed the private
information of millions of children along with their parents. The company settled this
dispute with FTC by paying a fine of $650,000 (Cluley, 2018). Another good example is ‘Mirai
Botnet’ which is a Japanese malware that launched an attack on numerous IoT devices in
2016. This malware targeted IP cameras and home routers, and it was the largest attack
which leads to a widespread Distributed Denial of Service (DDoS) attack. The objective of
this attack was to make certain online business unavailable to its users by relying on
overwhelming traffic which was sent through multiple sources (Fruhlinger, 2018). This attack
was a good example which reminded that breach of IoT devices has the potential to affect
millions of people across the globe adversely.
 Protecting data from corporations
Other than cyber criminals, the users of IoT devices have to protect their data from the
corporations as well who sell the IoT devices. The IoT devices work properly by collecting
private data of users through their sensors and sending such data to their main server.
Many times, the corporations who are producing these devices collect all this data on their
servers without the permission of the clients (Ziegeldorf, Morchon, and Wehrle, 2014). This
violates the privacy of users, and it increases the requirement of protection of data from
corporations. Generally, large corporations such as Apple and Google have the resources to
build IoT devices which did not send the data of the user to them, and it collects the data on
the device itself. However, other cheaper IoT devices which have become popular
worldwide can easily send the private data of users to the main servers of the company
which raises various security and privacy concerns.
 Limited encrypting capabilities
The sensors which are installed on an IoT device lacks sophisticated process capabilities
which are important for encryption and decryption of data. Since all IoT devices
continuously collect and share data with other devices, it becomes important that such data
is encrypted property to so that third parties are not able to access such data. However,
since people purpose IoT devices from different companies, it becomes difficult for them to
implement encryption and decryption technique which works on all devices (Jing et al.,
Page 4

2014). As a result, the IoT devices are highly vulnerable to side channel attacks in such cases
cyber criminals can easily find loopholes to collect private data of users.
 Handling privacy issues
All businesses and corporations are focusing on collecting data on their users because data
enables them to collect market insights which assist them in creating business
opportunities. IoT devices can be used by corporations to collect the data on users which
assist them in forming business strategies which result in increasing their profitability
(Whitmore, Agarwal and Da Xu, 2015). Thus, the importance of a strict legal framework
increases which is focused on ensuring that the privacy and security of customers are
maintained while using IoT devices.
 Managing security updates
Although security updates improve the security of devices from unauthorised access,
however, many times the IoT devices did not support over the air security update and
customers have to physically access the device to update the same (Yan, Zhang, and
Vasilakos, 2014). Thus, many customers did not update their devices which put their
security and privacy at the risk of violation.
Conclusion
Based on the above observations, it can be concluded that the popularity of IoT devices will
continue to grow across the globe. As the number of IoT users will increase, the privacy and
security concerns relating to the IoT technology will increase as well. Since IoT devices
collect private data of users, they become the potential target of cyber criminals to collect
confidential and sensitive information regarding the users. There are various private and
security issues relating to IoT technology, such an ensuring the integrity of data, protecting
the data from the attack of cyber criminals, protecting of data from corporations, limited
encryption, and decryption capabilities and others. These issues increase the requirement of
improvement in the IoT technology to ensure that the privacy and security of users are
maintained.
Page 5

References
Cluley, G. (2018) Post-hack, VTech has to pay $650,000 in FTC settlement. [Online] Available
at: https://www.bitdefender.com/box/blog/iot-news/post-hack-vtech-pay-650000-ftc-
settlement/ [Accessed on 24th October 2018].
Fruhlinger, J. (2018) The Mirai botnet explained: How teen scammers and CCTV cameras
almost brought down the internet. [Online] Available at:
https://www.csoonline.com/article/3258748/security/the-mirai-botnet-explained-how-
teen-scammers-and-cctv-cameras-almost-brought-down-the-internet.html [Accessed on
24th October 2018].
Gubbi, J., Buyya, R., Marusic, S. and Palaniswami, M. (2013) Internet of Things (IoT): A vision,
architectural elements, and future directions. Future generation computer systems, 29(7),
pp.1645-1660.
Jing, Q., Vasilakos, A.V., Wan, J., Lu, J. and Qiu, D. (2014) Security of the Internet of Things:
perspectives and challenges. Wireless Networks, 20(8), pp.2481-2501.
Lee, I. and Lee, K. (2015) The Internet of Things (IoT): Applications, investments, and
challenges for enterprises. Business Horizons, 58(4), pp.431-440.
Lueth, K.L. (2018) State of the IoT 2018: Number of IoT devices now at 7B – Market
accelerating. [Online] Available at: https://iot-analytics.com/state-of-the-iot-update-q1-q2-
2018-number-of-iot-devices-now-7b/ [Accessed on 24th October 2018].
Miorandi, D., Sicari, S., De Pellegrini, F. and Chlamtac, I. (2012) Internet of things: Vision,
applications and research challenges. Ad hoc networks, 10(7), pp.1497-1516.
Roman, R., Zhou, J. and Lopez, J. (2013) On the features and challenges of security and
privacy in distributed internet of things. Computer Networks, 57(10), pp.2266-2279.
Whitmore, A., Agarwal, A. and Da Xu, L. (2015) The Internet of Things—A survey of topics
and trends. Information Systems Frontiers, 17(2), pp.261-274.
Page 6

Yan, Z., Zhang, P. and Vasilakos, A.V. (2014) A survey on trust management for Internet of
Things. Journal of network and computer applications, 42, pp.120-134.
Ziegeldorf, J.H., Morchon, O.G. and Wehrle, K. (2014) Privacy in the Internet of Things:
threats and challenges. Security and Communication Networks, 7(12), pp.2728-2742.
Page 7