Before we begin, we need to understand what is the Internet of Things (IoT)? IoT is any device with an On and Off switch which is connected to the internet and/or connected to each other. The IoT devices include mobile phones, coffee makers, washing machines, headphones, lamps, etc. According to Bernard Marr in “17 Internet of Things Facts Everyone Should Read”, Automated Teller Machines (ATMs) were the first IoT as far as the year 1974. IoT is also defined as the device that collects and transmits data via the internet.

Previously, I wrote about Top 3 Technologies that in my view would become more relevant in 2022 and IoT was one of the technologies mentioned. Hence, today I would like to focus on the challenges of implementing IoT and how companies are maximising the use of IoT. Every technology has its challenges and by knowing what to anticipate would better prepare us in making the right decision with calculated risks.

Dependency On the 3rd Party Vendor

The IoT device is a hardware or appliance, and we are depending on the Manufacturer to make sure the IoT device is secure and sturdy. The device should not include embedded password at the firmware level which any default password would compromise the whole hardware. The Manufacturer should address weak passwords, patching mechanisms and mitigate any insecure data storage.

To achieve this, we should have a more stringent SLA and standards agreement with the Manufacturer for them to comply in their production. A secure engineering practice should be applied and integrated into the product lifecycle management. The device should be able to operate in a hostile environment and fail safely when compromised.

User Awareness on IoT

I always emphasise the Human Factor or End User when we discuss technology implementation. Our End Users should really understand how the IoT works, and the implication should these IoT devices be compromised. In 2010, the Stuxnet Worm attacked the Iranian nuclear facility and infected the centrifuge controlling software. Modern centrifuge is heavily IT dependent as it is a type of IoT device. The attack was originated by an unscanned USB drive plugged into one of the plant’s computers. Reports estimated that Stuxnet Worm had physically damaged about 1000 centrifuges. Fortunately, it did not end up as a nuclear disaster and all of this because 1 user forgot to scan the USB drive.

It is already a challenge to bring average users to adapt to cyber threats and avoid phishing emails, suspicious attachments and to regularly scan their computer with the antivirus. Our users should be very prudent and aware that IoT devices are even more fragile and susceptible to attacks due to the interconnected nature and build. The more the IoT devices we have, the more probability of attack exposure that we would need to confront.

Difficulty in Hardening and Patching

Updates are needed to keep the IoT devices secure and up to date. This is because new vulnerabilities will inevitably be discovered at some point in the future regardless of how much effort the Manufacturer put into creating a secured hardware and software for the IoT device. How these IoT devices are being updated is another question. Imagine that we need to update the sensors that spread across hundreds of acres of plantation field?

Getting a maintenance window is also a challenge. How about the International Airports operations that are running 24×7? Only a very small window would be given to carry out the system maintenance and change deployment. I guess, the COVID-19 pandemic was also a blessing in disguise where IT has sufficient windows to carry out all these hardening and patching updates to make sure all the IoT devices are secured and intact.

Sufficient Physical Security

The IoT devices are usually scattered, and some are placed in remote locations like the sensors for the weather stations. These IoT devices also run with very little or no human intervention at all. These IoT devices may stay for weeks if not months before any physical checking on them. Therefore, it is prone to theft and vandalism.

Even worse, if the device itself is not stolen but the criminal would induce a malware onsite or tapping for sensitive information. Just imagine the adverse impact should this data fall into the wrong hands. The impact of malware is also serious with all the cost to be spent to recover and repair all these IoT devices. That is why the need for sufficient physical security to protect our IoT investments from loss or tampering.