Packt+ | Advance your knowledge in tech

You're reading from Practical Internet of Things Security - Second Edition

Product typeBook

Published inNov 2018

Publisher

ISBN-139781788625821

Edition2nd Edition

Tools

AWS Azure

Concepts

Internet of Things Security

Authors (2):

Brian Russell

Drew Van Duren

View More author details

Chapter 8. Mitigating IoT Privacy Concerns

As your family sits down after dinner and a long day of work, one of the children starts up a conversation with her new connected play doll, while the other begins to watch a movie on the new smart television. The smart thermostat is keeping the living area at steady 22°C, while diverting energy from the rooms that aren't being used at the moment. Father is making use of the home computer's voice control features, while mother is installing new smart light bulbs that can change color on command or based on variations in the home environment. In the background, the smart refrigerator is transmitting an order for the next-day delivery of groceries.

This setting tells a great story about the consumer Internet of Things (IoT) in that there are exciting new capabilities and conveniences. It also begins to make clear the soon-to-be hyper-connected nature of our homes and environments. If we start to examine these new smart products, we can begin to see...

Privacy challenges introduced by the IoT

The privacy challenges with the IoT are enormous, given the vast quantities of data collected, distributed, stored and, ahem, sold every day. Pundits will argue that privacy is dead today. They argue that consumer willingness to click eagerly through so-called end user privacy agreements compromises their privacy, with barely a notion as to what they just agreed to. The pundits are not far off, as privacy concerns are something of a moving target given the fickle nature of consumer sentiment.

Our ability to grasp and find ways of preserving privacy with the IoT represents a monumental challenge. The increased volume and types of data able to be collected and distilled through technical and business analytical systems can produce frighteningly detailed and accurate profiles of end users. Even if the end user carefully reads and agrees to the end user privacy agreement, they are unlikely to imagine the downstream, multiplicative, compromising effect...

Guide to performing an IoT PIA

An IoT PIA is crucial for understanding how IoT devices, within the context of a larger system or system-of-systems, may impact end user privacy. This section will provide you with a reference example of how to perform a PIA for your own deployment, by walking through a hypothetical IoT system PIA. Since consumer privacy is such a sensitive topic, we provide a consumer-level PIA for a connected toy.

Overview

PIAs are necessary to provide as complete a risk analysis as possible. Beyond basic safety and security tenets, unmitigated privacy losses can have a substantial impact and result in severe financial or legal consequences for a manufacturer or operator of IT and IoT systems. For example, consider a child's toy fitted with Wi-Fi capabilities, smartphone management, and connectivity to backend system servers. Assume the toy possesses a microphone and speaker, along with voice capture and recognition capabilities. Now consider the security features of the device...

Privacy by design

A UK Department for Digital, Culture, Media and Sport (DCMS) report on IoT certification referenced a survey of 1,000 consumers. The consumers identified prioritized requirements for IoT information that would be beneficial during a purchase. One of these requirements included transparency of privacy, to cover the following:

Type of personal data collected
Whether data is shared with third parties
Whether consumers can opt out of sharing

Each of these data points is covered under a PbD approach. PbD is based on a set of privacy principles. PbD is also a requirement for GDPR. Aligning a VDOO certification with PbD principles would provide consumers and businesses with data to prove that a vendor has met a minimum set of privacy requirements. This alignment is difficult, however, since privacy encompasses the entire IoT system (rather than only the device that collects the information):

Privacy engineering recommendations

Privacy engineering is a relatively new discipline that seeks to ensure systems, applications, and devices are engineered to conform to privacy policies. This section provides some recommendations for setting up and operating a privacy engineering capability in your IoT organization.

Whether a small startup or a large Silicon Valley tech company, chances are you are developing products and applications that will require PbD capabilities built in from the ground up. It is crucial that the engineering processes are followed to engineer a privacy-respecting IoT system from the outset and not bolt the protections on later. The right people and processes are first needed to accomplish this.

Privacy throughout the organization

Privacy touches a variety of professions in the corporate and government world; attorneys and other legal professionals, engineers, QA, and other disciplines become involved in different capacities in the creation and adoption of privacy...

Summary

Protecting privacy is a serious endeavor made even more challenging with the IoT's myriad forms, systems of systems, countless organizations, and the differences in which they are addressed across international borders. In addition, the gargantuan amount of data being collected, indexed, analyzed, redistributed, reanalyzed, and sold provides challenges for controlling data ownership, onward transfer, and acceptable use. In this section, we've learned about privacy principles, privacy engineering, and how to perform privacy impact assessments in support of an IoT deployment.

In Chapter 9, Setting Up a Compliance Monitoring Program for the IoT, we will explore starting up an IoT compliance program.

The rest of the chapter is locked

You have been reading a chapter from

Practical Internet of Things Security - Second Edition

Published in: Nov 2018Publisher: ISBN-13: 9781788625821

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Authors (2)

Brian Russell

Brian Russell is the founder of TrustThink, LLC, where he leads multiple efforts towards the development of trusted IoT solutions. He has over 20 years of information security experience and has led complex system security engineering programs in the areas of cryptographic modernization, cryptographic key management, unmanned aerial systems, and connected vehicle security. He is the co-chair of the Cloud Security Alliance (CSA) IoT Working Group and was the recipient of the 2015 and 2016 CSA Ron Knode Service Award. Brian is an adjunct professor at the University of San Diego (USD) in the Cyber Security Operations and Leadership program.
Read more about Brian Russell

Drew Van Duren

Drew Van Duren has provided 20 years of support to commercial and government customers in their efforts to secure safety-of-life and national security systems. He has provided extensive applied cryptographic design, key management expertise, and system security architecture design through rigorous integration of system security design with the core engineering disciplines. Drew has managed as Technical Director the two largest FIPS 140-2 test laboratories, security-consulted for the New York City Connected Vehicle Pilot Deployment, and participated in multiple standards groups such as the RTCA, SAE, and IEEE 1609 working group. Today, he supports the IEEE P1920 committee heading security architecture for unmanned aircraft aerial networks.
Read more about Drew Van Duren

Other recommended products

Related to this chapter

Hands-On Cryptography with Python

Cryptography is essential to protect sensitive information, but it is often performed inadequately or incorrectly. This book will show how to encrypt, evaluate, compare, and attack your data using Python. Overall, the book will help you deal with the common errors in encryption and would know how to exploit them.

BookJun 2018100 pages

Practical Industrial Internet of Things Security

This book provides you with a comprehensive understanding of Industrial IoT security; and practical methodologies to implement safe, resilient cyber-physical systems. It will help you develop a strong foundation and deeper insights on the entire gamut of securing connected industries, from the edge to the cloud.

BookJul 2018324 pages

Azure IoT Development Cookbook

It is important to develop robust and reliable solutions for your organization to leverage IoT services. Microsoft’s end-to-end IoT platform is the most complete IoT offering. It empowers enterprises to build and realize value from their IoT solutions for innovative business outcomes with Microsoft Azure IoT. This book will teach you how to connect multiple devices to the Azure IoT hub, develop, manage the IoT hub service, and integrate the hub with the cloud.

BookAug 2017254 pages

IoT Penetration Testing Cookbook

IoT is an upcoming trend in the IT industry today; there are a lot of IoT devices on the market but there is a minimal understanding of how to safeguard them. If you are a security enthusiast or pentester, this book will help you understand how to exploit and secure IoT devices. You will learn how to identify vulnerabilities in IoT device architecture and firmware using software and hardware pentesting techniques, and you'll also focus on various IoT exploitation techniques and security automation.

BookNov 2017452 pages

Hands-On Security in DevOps

Hands-On Security in DevOps explores how the techniques of DevOps and Security should be applied together to make cloud services safer. By the end of this book, readers will be ready to build security controls at all layers, monitor and respond to attacks on cloud services, and add security organization-wide through risk management and training.

BookJul 2018356 pages

Enterprise Internet of Things Handbook

Internet of Things is today and now. This “hand” book covers almost all the bare essential knowledge that is needed for an architect or a developer to build IoT solution. Right from understanding what IoT is and exploring various off of the shelf IoT platforms, this book has it all. This book also covers Machine Learning IoT at a basic level using Azure Machine Learning Studio.

BookApr 2018332 pages

Developing IoT Projects with ESP32

ESP32 is a low-cost, low-power MCU series by Espressif systems that can be used in wireless IoT applications. With Wi-Fi and Bluetooth technologies as well as security features, it's a full-fledged SoC for developing IoT products for consumer and industrial markets. This book will help you get up to speed with ESP32 using interesting projects.

BookSep 2021474 pages

Building Bluetooth Low Energy Systems

Technology is expanding and so are our networks. The coming era is the age of the Internet of Things and it requires a seamless integration of software with hardware. The need for power-efficient connectivity is greater than ever. Bluetooth Low Energy presents a low-cost, small-distance communication platform that completely solves this problem. This book will introduce you to the technical aspects and implementation of BLE, which will enable you to create customized Bluetooth Low Energy Systems for day-to-day use.

BookApr 2017242 pages

Information Security Handbook

Having an information security mechanism is one of the most crucial factors for any organization. Important assets of organization demand a proper risk management and threat model for security, and so information security concepts are gaining a lot of traction. This book covers the concept of information security, and shows you why it’s important.

BookDec 2017330 pages

Modern Cryptography for Cybersecurity Professionals

Every minute of the day, there are petabytes of data exchanged between our homes, cars, businesses, and IoT devices. But just what exactly is involved when using cryptographic techniques? Modern Cryptography for Cybersecurity Professionals will help you to understand common cryptographic techniques and terms used today to secure our data.

BookJun 2021286 pages

Internet of Things for Architects

The Internet of Things (IoT) is the most significant factor in the technology industry in the last 10 years. It will usher in the third industrial revolution and significantly impact global economies. Industry giants are in the process of adopting IoT solutions to add value, reduce costs, and improve people’s lives. As such, the architectural side of IoT has become critical. This book will help you understand the plethora of technologies that can be used to build a successful IoT deployment. This professional guide will help you architect IoT solutions for a variety of industries and organizations.

BookJan 2018524 pages

IoT and Edge Computing for Architects

New edition of the top-selling guide to IoT and edge computing for architects that helps you create IoT solutions for a variety of industries and organizations.

BookMar 2020632 pages

Personalised recommendations for you

Based on your interests and search pattern

Architectural Patterns and Techniques for Developing IoT Solutions

This book covers all the patterns and considerations that give you both the power and flexibility to build scalable, secure, and performant IoT solutions by combining various patterns in interesting ways. It also lists the benefits of combining IoT with technologies like blockchain, 3D-printing, 5G, Generative AI, quantum computing, and LLMs.

BookSep 2023304 pages

Arduino Data Communications

Arduino Data Communication focuses on IoT’s Internet aspect, guiding you in setting up your own infrastructure for storing and managing the data collected from sensors. This book goes beyond microcontroller basics, equipping you with the knowledge essential for building real-world projects.

BookNov 2023286 pages5

Arduino IoT Cloud for Developers

From fundamental principles to advanced techniques, this comprehensive book equips you with the knowledge and skills needed to design and deploy IoT applications seamlessly. Explore cloud integration, best practices, and real-world projects to harness the full potential of IoT application development with the Arduino IoT Cloud.

BookNov 2023402 pages

The Azure IoT Handbook

Building IoT Systems with Azure IoT is a comprehensive introduction for those who are new to the Internet of Things and looking to get up to speed in no time. This book will teach you how to create and develop IoT solutions with intelligent edge-to-cloud technologies in the Azure cloud.

BookDec 2023248 pages

Principle

Description

Proactive not reactive; preventive and not remedial

Within the context...