You Ask We Answer 5. Why Is IoT Insecure?

Internet of Things devices remain insecure despite years of warnings from security researchers about the lack of or improper defenses in connected systems. Typically, the poor state of IoT security starts with the manufacturer and continues under the end-user’s control.

Without an enforced standard for baseline security, IoT manufacturers are free to focus solely on the functionality of the device. In many cases, they don’t check for vulnerabilities in the final version of the firmware code that powers the product or in the companion app.

It could be negligence, but a more common explanation is that this approach lowers production costs and accelerates time to market. Either way, the effect burdens the consumer, who risks financial damage or the loss of sensitive information when hackers start exploiting the flaws.

More often than not, the firmware integrates third-party code that becomes outdated at some point. If this happens during production, refreshing it is usually synonymous with taking a few steps back to check for compatibility. Releasing an update after launching the product means preparing an update mechanism that works correctly, which translates to higher initial manufacturing costs.

Many IoT makers will trade security for convenience, but not all of them want to risk lost business or a tarnished reputation to make a quick buck. Big names in the IoT industry do invest in research and assess the security of their products before putting them on the shelves.

However, even the best made IoT systems can’t withstand hacker attacks on their own. Vendors provide protection options, but it is the end user who needs to enable and customize them to increase resistance against compromise attempts or even discourage the effort completely. Leaving the default login credentials and exposing the gadget unnecessarily on the web are invitations to unauthorized access.

So, the reason behind the insecurity of IoT devices lies partly with manufacturers that fail to ship quality products, and partly with users who fail to use the security options they do have.

Image credit: Anemone123