Smart Devices a 'Major Threat' when it comes to Cyber Warfare

A Harvard lecturer has warned Congress that only government regulations can prevent serious consequences from security attacks on the "Internet of Things." Bruce Schneier says there's little market incentive for buyers or sellers to fix a problem, should a problem arise.

The Internet of Things (IoT) refers to the growing number of devices that can now be connected to the Internet, making them "smart devices". Rather than just computers and phones, the Internet of Things covers everything from thermostats to cars, often with the Internet connection allowing users remote access to change settings.

Most of the security stories around the Internet of Things have centered on the possibilities of attackers remotely accessing or controlling such devices, causing mischief or worse. However, last month hackers were able to take advantage of unsecured devices and turn them into a distributed denial of service (DDoS) attack, which then brought down several major websites.

Internet of Things Makes for Cheap and Easy Attacks

Such an attack normally involves getting a network of infected computers to flood a site with bogus requests for data until it simply can't cope with the flood, and therefore legitimate traffic is blocked. Being able to incorporate other devices (such as a smart refrigerator) for such a tactic is particularly valuable, because denial of service attacks are as much about the sheer quantity of devices making the bogus requests as they are the individual computing power of the devices.

Schneier told two Congressional subcommittees that the nature of the smart device market means its unlikely people will improve security on their own. He notes that most of the devices are produced cheaply and with low profit margins (with a large volume of sales turning profits), and thus manufacturers are wary of spending too much on bossing security on these devices.

Meanwhile buyers often don't know when their devices are compromised and have no easy way to patch the device. Schneier also noted that because household devices tend to be used for much longer before being replaced than phones and tablets are, the chances are that they'll stay compromised for much longer.

Politicians Uneasy About Controls

Politicians however were wary about the suggestion, with one calling it a "knee-jerk reaction." They also questioned how much difference regulations could make given that so many devices are manufactured outside of the US. (Source: computerworld.com)

The discussion follows on from both the Department of Homeland Security and the National Institute of Standards and Technology publishing suggestions on how smart devices could be better secured. (Source: thehill.com)

What's Your Opinion?

Do smart devices need better security? If so, is government regulation the way to go? Is there any point trying to regulate devices when foreign-made ones would likely be exempt?