Why your IoT devices are the weakest link in security

The Fast Company Impact Council is a private membership community of influential leaders, experts, executives, and entrepreneurs who share their insights with our audience. Members pay annual membership dues for access to peer learning and thought leadership opportunities, events and more.

As the number of internet of things (IoT) devices is projected to reach 40 billion by 2030, IoT integration into our daily lives is undeniable. From smart homes to industrial systems, IoT devices offer unprecedented convenience and efficiency. Netgear’s 2024 IoT Security Landscape report found that IoT devices, including TV sets, smart plugs, routers, and more face frequent attacks, with an average of 10 per device, per day. The rapid adoption of IoT is outpacing the security measures necessary to protect them.

The rise of IoT goes beyond smart homes, reaching into critical sectors like healthcare, utilities, and transportation, where the stakes are far higher. A security breach in these areas could lead to devastating outcomes, from personal data theft to operational disruptions in essential operations. To fully realize IoT’s potential, it is crucial to rethink device security, establish stronger standards, and foster a security-first culture that aims to protect the systems driving our future.

The explosion of IoT—and its security gaps

The rise of IoT has been transformative. What began as simple, smart devices in homes has expanded into a vast, interconnected ecosystem that touches nearly every industry such as agriculture, healthcare, transportation, and manufacturing. IoT devices now power real-time decision making, automate complex systems and optimize operations at a global scale. However, significant security gaps threaten to undermine these benefits. Many IoT devices lack fundamental protections like encryption, regular firmware updates, and secure boot processes. The issue is compounded by the sheer volume of devices now deployed—each a potential entry point for attackers. In many cases, once an IoT device is compromised, it can serve as a gateway to more critical systems, creating a ripple effect of vulnerabilities across entire networks.

Key risks include default security settings, limited processing power and memory, and the lack of standardized security protocols across the IoT ecosystem. These gaps allow attackers to exploit devices to access sensitive data, disrupt essential services, or breach larger, more critical networks, putting the integrity of entire systems at risk.

The role of users and manufacturers in IoT security

IoT security is a shared responsibility between users and manufacturers, who play crucial roles in safeguarding devices from cyber threats. Manufacturers are primarily responsible for designing and developing secure devices, but they sometimes need to prioritize time-to-market over comprehensive security features. Many IoT devices, such as smart home gadgets, cameras, and wearables, are produced by companies with limited experience in cybersecurity, leading to vulnerabilities in device firmware and communication protocols. Inadequate testing and security oversight at the design and development stages expose devices to risks like unauthorized access and data breaches.

On the user side, negligence in maintaining device security further exacerbates these risks. Users often fail to change default passwords, leaving their devices vulnerable to brute-force attacks. Users often do not regularly update firmware or software, unaware that patches are released to fix known vulnerabilities. Many consumers also need to gain awareness of the potential privacy risks, such as the misuse of personal data collected by their devices, which can be exploited if not correctly and adequately protected.

The complexity of addressing these issues lies in the need for more standardization across the industry. Manufacturers often release products with proprietary systems that don’t always adhere to universal security frameworks, making it difficult for users to implement best practices consistently. Without standardized security protocols and better consumer education, the IoT ecosystem will continue to face challenges.

Implement best practices for IoT security

As IoT systems are integrated into critical infrastructure and daily life, evolving policy changes are essential to address growing risks. Regulatory frameworks, such as stricter data protection laws and mandatory security standards for IoT devices, will play a pivotal role in enhancing the security environment. Governments and organizations should work together to develop global security standards that mandate encryption, authentication protocols, and regular software updates. These policies will not only encourage manufacturers to design more secure devices but also hold companies accountable for maintaining security throughout the lifecycle of their products.

Given the scale and complexity of IoT ecosystems, traditional security measures often fall short.   This is where AI and machine learning can play a transformative role. AI-driven security systems can analyze large datasets generated by IoT devices in real-time, identifying anomalies that might signal a breach. Machine learning algorithms improve over time, enabling them to predict and preempt emerging threats before they escalate. That said, the technologies’ effectiveness depends on its proper integration with existing security infrastructures and ongoing updates informed by the latest threat intelligence.

Your voice matters. Insist that manufacturers prioritize security by choosing products from companies that are transparent about their security practices and committed to regular updates. By supporting policies and initiatives that push for better security practices across the board, you help ensure that all devices, from the smallest sensor to the most complex system, are built with security in mind.

Svetlin Todorov is cofounder of Shelly and CEO of Shelly U.S.A.

View the full article