A virtually invisible phenomenon. Billions of devices and trillions of dollars. Zero regulation and non-existent security protocols. No, we are not talking about the next pandemic. Recently, the Internet of Things, or "IoT" for short, has been stealing headlines. Unfortunately, these headlines do not often showcase new and innovative product lines. Rather, they focus on the significant uptick of data breaches, DDOS attacks, and cybercrime perpetrated through vulnerable IoT devices.

Unregulated IoT

The problem is simple: IoT is largely unregulated—and unregulated at every touch point. There are virtually no security standards, virtually no manufacturing standards or industry requirements, and virtually no privacy or legal guidelines. Yet, these unregulated IoT devices are ubiquitous. Surveillance cameras, connected home devices, fitness trackers and other wearables, connected work devices, connected medical devices, smart speakers, and connected vehicles are just a few of the numerous IoT device categories that give way to tens of billions of devices sold and used globally. This number is projected to top 30 billion devices by 2025, with total end user spend reaching 1.6 trillion dollars.

How Did We Get Here?

The reasoning behind this lack of security and privacy protection is multifaceted. First, most IoT devices are designed to deliver the maximum functionality at a bargain basement price. It is difficult to include security, privacy, and regulatory compliance into the reasonable price of a lightbulb. Second, most IoT devices are designed to be long lasting and essentially maintenance free. As a result, manufacturers have failed to focus on upgradeability, with many products receiving few, if any, security updates or patches. Often, users of these devices are not told to, and may not think to, change the default security settings, leaving their devices vulnerable to those who know or can guess default usernames and passwords. Even if the end user is savvy enough to attempt to change the default settings, those very settings are usually buried within a complex series of menus that are difficult to access. Third, many IoT devices come from suspect lineage, manufactured in countries with even fewer regulations by parties with potentially dubious motivations and suspect data practices. What results from this widespread security failure are frequent data breaches that have the potential to reveal intimate details about users' personal and work lives.