The Internet of Things -- interconnected devices like appliances and security alarms -- are fine but it's important to protect them against errant humans, a report from the Federal Trade Commission (FTC) cautions.
Consumers are rushing to install Internet-enabled thermostats, smoke alarms, security systems, health and fitness monitors and cars, a trend that promises improved security, economy and efficiency but that also raises privacy and security concerns.
"The only way for the Internet of Things to reach its full potential for innovation is with the trust of American consumers," said FTC Chairwoman Edith Ramirez. "We believe that by adopting the best practices we've laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized."
There are already more than 25 billion connected devices in use worldwide, with that number set to rise significantly as consumer goods companies, auto manufacturers, healthcare providers, and other businesses continue to invest in connected devices, according to data cited in the report.
The report is partly based on input from leading technologists and academics, industry representatives, consumer advocates and others who participated in the FTC's Internet of Things workshop held in Washington D.C. on Nov. 19, 2013, as well as those who submitted public comments.
Security was one of the main topics addressed at the workshop and in the comments, particularly due to the highly networked nature of the devices. The report includes the following recommendations for companies developing Internet of Things devices:
- build security into devices at the outset, rather than as an afterthought in the design process;
- train employees about the importance of security, and ensure that security is managed at an appropriate level in the organization;
- ensure that when outside service providers are hired, that those providers are capable of maintaining reasonable security, and provide reasonable oversight of the providers;
- when a security risk is identified, consider a "defense-in-depth" strategy whereby multiple layers of security may be used to defend against a particular risk;
- consider measures to keep unauthorized users from accessing a consumer's device, data, or personal information stored on the network;
- monitor connected devices throughout their expected life cycle, and where feasible, provide security patches to cover known risks.
Commission staff also recommend that companies consider data minimization - that is, limiting the collection of consumer data, and retaining that information only for a set period of time, and not indefinitely.
The report notes that data minimization addresses two key privacy risks: first, the risk that a company with a large store of consumer data will become a more enticing target for data thieves or hackers, and second, that consumer data will be used in ways contrary to consumers' expectations.
How they voted
Yes
Yes