Securing Billions of IoT Devices Poses Mind-Boggling Challenges

The Internet of things presents some significant security challenges that need to be dealt with now before big problems arise.

IoT security

The first week in May was a big one for the Internet of things in Massachusetts.

Actually, it was officially "Internet of Things Week" in the state, as proclaimed by Gov. Deval Patrick and wrapped around a number of events in Boston and Cambridge meant to celebrate the coming boom of highly connected devices and systems that promise to transform the way we live and conduct business.

The events included a developer competition—the IoT Olympiad—and the 5th Annual Auto-ID & Sensing Solutions Expo, as well as the NFC Bootcamp for learning all things near-field communication.

However, among all the hoopla, security experts gathered in a hotel conference room in Cambridge May 7 to talk about the security and privacy challenges the IoT presents. The mood at the Security of Things Forum was decidedly darker than elsewhere around Boston that week. While noting the promised benefits of the IoT, the talk was more about technological hurdles to securing the devices and data, the reluctance of some businesses to spend money on security and the complacency of many people about protecting their personal information.

The sheer numbers are daunting, some of the experts said. At a time when the world is struggling with protecting the systems—and the data they hold—that already are connected, how will people be able to secure the tens of billions of connected devices expected by the end of the decade?

"The IoT ... should raise the hackles on every neck, given our current" security situation, said Dan Geer, chief information security officer for venture capital firm In-Q-Tel.

The numbers are staggering. Gartner analysts expect that by 2020, there will be 26 billion connected devices; Cisco Systems officials say that number will be more like 50 billion. These will include everything from smartphones and tablets to home appliances, industrial systems, cars, wearable devices, thermostats, light bulbs, surveillance cameras and airplanes, all of them communicating with each other and swapping data.

And it will be big business. IDC analysts expect IoT revenues to hit $7.1 trillion by the end of the decade. Cisco CEO John Chambers earlier this year said the global financial impact of what he calls the Internet of everything will be $19 trillion by 2020. At the 2014 Consumer Electronics Show Jan. 7, Chambers said the Internet of everything "will be bigger than anything that's ever been done in high tech," and added that "this is not about technology at all. It's about how it changes people's lives forever."

Those huge numbers are part of what have security experts concerned. When talking about the Internet of things, there are three key security challenges, according to Don Ferguson, senior fellow, vice president and CTO of Dell's Software Group: the number of connected devices, their diversity and their connectedness.

"The Internet of things scares me," Ferguson said during a recent roundtable discussion in Boston hosted by Dell. "My first reaction is to sleep with the lights on. But now a kid in China can turn the lights off."