Assessing the Security Concerns in the Expanding Internet of Things Market: A Symantec Study

In our hyper-connected world, the Internet of Things (IoT) market has begun to soar. It feels like every other day there’s a new smart gadget gracing our store shelves, promising to revolutionize our daily lives. Consumers have jumped aboard, and are eagerly snapping up connected versions of virtually every household appliance conceivable. Regrettably, with the technological advancement comes the worsening issue of device security. Despite the overwhelming acceptance of IoT by consumers, recent research indicates that the term “security” rarely makes its way into discussions about this new generation of devices. This leaves consumers potentially vulnerable and exposed.

Keen to delve deeper into this concerning issue, we examined the security measures of 50 popular smart home devices currently available in the market. Our findings were less than encouraging. A glaring issue was that none of these devices enforced strong passwords, utilized mutual authentication, or provided protection against brute-force attacks. A troubling nearly 20% of the mobile apps used for controlling these IoT devices did not use Secure Sockets Layer (SSL) to encrypt communications to the cloud. Additionally, we uncovered a host of common vulnerabilities latent within the tested IoT technology.

It’s crucial to note that most of the potential weaknesses identified, like authentication and traffic encryption, are not news to the security industry. Yet despite this, known mitigation techniques are frequently overlooked in the design and production of these devices. This raises serious questions about the role of IoT vendors in ensuring consumer safety. They need to prioritize security as much as, if not more than, functionality. Without robust security measures, widespread adoption of these devices could potentially place millions of people at risk of cyberattacks.

For a more comprehensive look at the findings of our study, you are invited to read the White Paper published by Symantec on the 12th of March, 2015.