IoT Security and Privacy

• IoT introduces novel applications but raises cybersecurity risks due to extensive data acquisition.
• 84% of IoT deployments have experienced a breach
• An average of 25 vulnerabilities are found per IoT device.
• Common IoT device issues: 80% lack complex passwords, 70% don't encrypt traffic, and 60% have vulnerable interfaces/firmware.
• Embedded devices have been attacked, with more expected in IoT.

Security vs. Privacy

• Security protects data from unauthorized access via control methods.
• Privacy protects user identity and personal information
• Privacy is more complex to define and manage than security.
• Understanding the distinction between security and privacy is crucial because they involve different risks and protection methods.

IoT Privacy Concerns

• IoT connects billions of devices, leading to a data explosion that presents privacy challenges.
• Individual IoT devices collect detailed data that, when combined, can create a comprehensive personal profile, especially with metadata.
• Smart TVs and gaming devices may continuously listen and record conversations, sending data to cloud services and third parties.
• High value of personal information leads companies to seek and capitalize on IoT data, challenging privacy protection.
• Users often lack knowledge or control over data collection
• IoT vendors may not prioritize user privacy if they consider data non-personal, even though combining non-personal data can reveal personal information.

IoT Security Concerns

• IoT devices are often small, ubiquitous, deployed in unprotected areas, and vulnerable to manipulation.
• Limited resources (memory, power) may prevent implementation of robust security measures like data encryption.
• Many IoT devices are autonomous with minimal human intervention.

Cybersecurity Threats include:

• Unauthorized Access: Weak security allows misuse of personal information; smart devices can be exploited for identity theft/fraud.
• Network Attacks: Vulnerabilities can facilitate attacks on connected networks; compromised IoT devices can launch DDoS attacks (e.g., Mirai malware).
• Physical Safety Risks: Attackers can remotely control physical devices like cars or smart meters, leading to potential burglary.
• Vandalism: Hackers may vandalize databases or RFID systems to cause financial damage.

Relation between Security and Privacy

• Robust security mechanisms are essential for maintaining privacy, but may limit the beneficial use of IoT data.
• Excessive privacy protections can complicate law enforcement efforts as governments may need access to data for surveillance and public safety.

Design Requirements for IoT Applications:

• Systems must avoid single points of failure and proactively adjust to maintain functionality during failures.
• Ensuring retrieved data (addresses, object information) is authentic and reliable.
• IoT device owners should have mechanisms to control access to their data.
• Safeguards must make it difficult for unauthorized parties to infer user identities from data.

Privacy and Security Enhancing Technologies

• Platform for Privacy Preference (P3P) was developed by W3C to help individuals manage their data privacy by categorizing data as public or private.
• Avoiding data sharing can reduce the usefulness of the information (e.g., location data for recommendations).
• Smartphones used in IoT systems can be exploited for Man in the Middle (MiM) attacks or Denial of Service (DoS) attacks.
• Ensuring authenticity and integrity of data between IoT devices and cloud services is crucial.

Authentication Methods

• Symmetric Authentication: uses a single shared key for both sender and receiver but has scalability issues.
• Asymmetric Authentication: involves a pair of keys, a private key for signing and a public key for verification, using digital certificates.
• Process: data is hashed and signed with the private key; the cloud service verifies by comparing hashes and checking the digital signature.
• Public Key Infrastructure (PKI) manages digital certificates and keys.
• It is widely used for securing electronic communications and is suitable for IoT applications

Considerations for IoT Devices:

• Security measures like encryption and digital signatures can be resource-intensive for IoT devices.
• Smart compromises balance security, privacy, and energy efficiency; data integrity might be prioritized over data secrecy.