Do you query Alexa at your house to get the weather? Are you able to change your house's thermostat setting while you are on the road? If you answered "yes", then you are using devices that are on the Internet of Things. The Internet of Things (IoT) is a recent development in Internet technology that is clearly here to stay.

The IoT is growing because devices that can communicate wirelessly are becoming inexpensive to make and efficient in their use of power. The adoption of IPv6 means that there essentially an unlimited number of internet addresses available, so it's now feasible to give any device its own internet address. An IoT device typically has sensors and logic circuits that let it think about what to do about the data it collects. An IoT device also typically has actuators that let it take actions based on the data sensed - for example a thermostat in your house that can raise or lower the temperature on its own. IoT devices often are built to communicate with other devices, without human intervention.

Typical industrial IoT devices are smart electric meters and security cameras. Such devices generate a great amount of data, which leads to their use in big-data applications. Typical consumer applications are smart TVs, speakers, security cameras, and thermostats. The Gartner Group estimates that 8.4 billion IoT devices were in use in the world in 2017. Gartner estimates that this number will grow to 20.4 billion in 2020. The adoption of 5G wireless communication will allow more networked devices to share more data at a faster rate, and so 5G is expected to further stimulate IoT growth.

The benefits to industry and to consumers will be significant. But there are privacy and security concerns that need to be addressed.

In an IoT world, sensors will be gathering data about us most of the time - in our homes, in our autos, in cities filled with cameras and drones. This data, combined with the data we give up in commercial transactions and in social media interactions, amounts to a nearly complete profile of a person's life. The possibilities for control and manipulation are Orwellian. Maintaining control over how such data is used by businesses and by the government will be an ongoing challenge. 

Two recent examples of security problems are described here. Early in 2019, researchers at the firm Safety Detective were able to take over internet-connected thermostats that are used in large freezers found in grocery stores and hospitals. The thermostats, which are manufactured by Resource Data Management company, come with weak default user names and passwords that users are supposed to change, but often don't. The Safety Detective researchers used Shodan, a search engine that can identify IoT devices, to locate many RDM thermostats in their area, and they were able to hack those that still had their default passwords. Of course, someone who is in control of such a thermostat could destroy the contents of the refrigerator.

In this module, you learned that a domain named server associates the name used to denote a web site (for example, DavesUsedCars.Com) with the IP address needed to actually locate the web site on the internet. One way to prevent a search engine from showing web pages would be to take away the ability to contact the domain name server used to acquire IP addresses. In 2016, a hacker was able to create a large botnet that was then used to launch a denial of service attack against Dyn, a domain name server company. Dyn is the server for many popular websites, such as Twitter, Pinterest, Reddit and PayPal. The denial of service attack meant that those sites were disabled for most of a day. How did the hacker create the botnet? The hacker apparently used a program called Mirai to identify IoT devices that have default user names and passwords. Mirai then used the default names and passwords to place the denial of service software on the IoT devices, mostly digital video recorders and web-based cameras. This software was then later unleashed to attack Dyn.

Security expert Brian Krebs points out that appliances like DVRs and security cameras contain components that are mass-produced by other companies. Krebs states: "To address the threat from the mass-proliferation of hardware devices such as Internet routers, DVRs and IP cameras that ship with default-insecure settings, we probably need an industry security association, with published standards that all members adhere to and are audited against periodically. The wholesalers and retailers of these devices might then be encouraged to shift their focus toward buying and promoting connected devices which have this industry security association seal of approval. Consumers also would need to be educated to look for that seal of approval. Something like Underwriters Laboratories (UL), but for the Internet".

In 2018, California became the first state with an IoT law. The SB 327 law takes effect in January 2020. Under the law "all connected devices" sold in the state must have "reasonable security features". It will be up to the state's attorney general to define what features are reasonable for specific devices. But, security expert Bruce Schneier points out "There's just one specific in the law that's not subject to the attorney general's interpretation: default passwords are not allowed".

In Module 8, you will encounter further discussion of the IOT.

 

Critical Thinking Questions:

1. Your doctor tells you that you need a pacemaker attached to your heart. She says "The device is on the internet! It will broadcast data about what your heart is doing all the time. We have software that will analyze this data in real time, 24 by 7. If we see any problems, we will contact you for treatment". Should you welcome this idea? What questions should you have for the doctor? For the pacemaker manufacturer?
2. 
   
3. Your company has upgraded its headquarters conference room. The room is now equipped with smart TVs, smart speakers and smart cameras. Today the room will be used to discuss merger ideas with your company's investment banking consultants. The participants are required to store their smartphones outside the room before the meeting starts. Should they also be required to store devices like the Fitbit activity tracker outside the room before the meeting starts?
4. 
   
5. An insurance company's executives see an opportunity in IOT device ransomware. At a meeting, the President says, "Hackers are going to be taking over things like automobiles and dead-bolt locks and demanding ransom for their re-activation. Should we sell ransomware insurance? If so, how much should we charge?" One marketing executive says, "We sell hole-in-one insurance. Holes in one are rare, so we make a lot of money on this insurance, even though we charge very little for it. Let's identify IOT devices that are unlikely to be attacked and charge a small amount to insure their ransom". Another executive says, "We sell home owner's and flood insurance. High valued items. We charge a lot for this. Let's sell ransomware insurance on the same catastrophe basis". What should the insurance company's ransomware strategy be?
6. 
   
7. If the Insurance company does insure against IOT ransomware, should the company be in favor of industry-group regulation of IOT devices

Answer rating: 100% (QA)

The Internet of Things IoT is a growing trend in technology that has the potential to bring many benefits to society However there are also some poten... View the full answer