Security framework for internet of things.

The Internet of Things or also known as IoT describes the network of physical objects or things that are embedded with sensors, software, and other technologies to connect and exchange data with other devices and systems over the internet.

The definition of the Internet of Things has evolved with the convergence of multiple technologies, real-time analytics, machine learning, commodity sensors, and embedded systems.Traditional fields of embedded systems, wireless sensor networks, control systems, automation (including home and building automation), and others all contribute to enabling the Internet of things. In the consumer market, IoT technology is most synonymous with products about the concept of the "smart home", including devices and appliances (such as lighting fixtures, thermostats, home security systems and cameras, and other home appliances) that support one or more common ecosystems, and can be controlled via devices associated with that ecosystem, such as smartphones and smart speakers.

There are several serious concerns about dangers in the growth of IoT, especially in the areas of privacy and security, and consequently, industry and governmental moves to address these concerns have begun including the development of international standards

People accept and manage risk. Consumers and companies make decisions based on their tolerance for risk and their estimates of both risk and the value provided by the “risky” activity. Perceptions of risk are shaped by knowledge and assumptions about safety: that manufacturers have made safe products, that standards and regulations provide guidance for production and use, and that courts will provide remedies if safety fails. It has become a routine practice in cybersecurity for researchers to announce some vulnerability or threat and for this to be picked up by the media. It is free publicity, but this practice can distort our understanding of risk and exaggerate it by taking an individual case out of context. Anecdote replaces analysis. What counts is an assessment of actual consequences. For IoT, while billions of IoT devices are in use, there has not been a single fatality attributed to them. This may change as the use of IoT devices expands and as the functions performed by IoT devices become more sophisticated. For now, the absence or risk should form the background for any approach to IoT.  

IoT creates three kinds of risk—an IoT device could malfunction; it could be hacked; or our efforts to protect privacy or make IoT devices more secure will create economic harm that outweighs the reduction in risk. Insurance companies calculate risk using actuarial data, historical records that show how often an event is likely to occur and what that event is likely to cost. We do not have actuarial data for most things in cybersecurity, including IoT. This makes the precise prediction of risk difficult, but we can define the factors that shape the risk equation: 

• Vulnerability: The ability of an attacker to gain access and control of a computing device, manipulating or extracting data or controlling or interrupting services. Most researchers believe that the computing devices used in the Internet of Things will be even more vulnerable than the Internet technologies to which we are accustomed, given the technical limitations of many IoT computing devices. Many of these devices will lack the computing power to perform traditional security functions of familiar desktops and laptops, which makes them easy targets
• Intent: Simply because an IoT device is vulnerable does not mean that someone will take advantage of it for malicious purposes. An attacker has to decide to exploit a vulnerability after calculating whether attack will provide political,military, economic, or social benefit. Intent can reflect simple malice, crime, espionage, terrorism, warfare—all of the usual motives seen in cybersecurity. 
• Consequences: Computing devices are vulnerable and attackers may exploit these vulnerabilities, but the final question is, so what? There is already a high level of violence, crime, and accident in societies, yet societies have a remarkable ability to absorb such things. Most of the vulnerabilities found in IoT devices lead to events that would qualify as pranks. The larger question is whether IoT introduces systemic vulnerabilities that would lead to a loss of life or significant economic harm. 

Many IoT devices are consumer goods. Scenarios for causing significant damage by hacking consumer IoT devices become increasingly problematic as we look for plausible situations where hacking consumer devices produced anything other than localized and temporary effect. Turning down refrigerators to cause milk to spoil could put additional stress on cows, dairy farmers, and grocery stores. As attacks go, however, this is not very frightening. To take an extreme case, if hackers were able to seize control of a critical aircraft system, leading to a crash, the effect could be equivalent to a terrorist bombing. This assumes, however, that the aircraft crew could not regain control. A straightforward precaution would be to ensure that the crew had the ability to override IoT systems or to reset the system to some basic operating configuration. Many devices we use now, such as aircraft, already are designed to deal with component failure, and pilottraining programs take failure into account. Similarly, taking control of an elevator would require defeating the three or four mechanical safety systems used by modern elevators. 

The repeatability of an IoT attack also determines its psychological impact. Hacks that appear to be repeatable and unstoppable will create fear and uncertainty, similar to the fear and uncertainty that gripped the United States after 9/11 when it was not clear that the suicide attacks were not the opening rounds of a long campaign of attacks. The ability to cause a plane to crash creates terror, but the inability to predict when and how often these incidents will be repeated increase that fear. Most accounts of IoT vulnerability assume that a single hacking incident can be duplicated on a mass scale, but in most instances, the challenge is not hacking a single car or refrigerator, it is hacking several thousand in situations and circumstances that produce mass effect. The number of variables involved in this kind of mass incident suggests that this kind of IoT hacking is very improbable. We do not want to extrapolate systemic effect from an example where hackers, under ideal conditions, can cause a single device to malfunction, into some larger threat to safety or security. The average level of dissonance and even chaos that modern economies accept as normal is high. IoT hacks would have to exceed this threshold to be noticeable.

Most IoT devices will not perform critical functions, nor will they generate or store critical data. This is particularly true for consumer IoT devices. This means that even if these consumer devices are hacked, the result is most likely to be annoyance. A nation with greater exposure to pranks does not face a surge in risk. It is systemic risk—the ability to create significant disruption by attacking a single critical node (like FedWire, the power grid, or a nuclear power plant) or by simultaneously attacking a large number of targets to produce significant effect. A simple precaution would be to ensure that some critical systems, which are not now linked to the Internet, remain disconnected until we can better assess and control risk. 

The questions over IoT security and privacy are a continuation the larger debates over Internet security and privacy in general. The issues are the same. What has changed in unhelpful ways is our attitude toward risk. The Internet was commercialized in a more optimistic era, when people were more tolerant of the risks that the new technology might hold. Internet security and privacy were left to the market, to the decisions of individual companies, and to a very light regulatory touch. This approach produced an Internet where crime is rampant but it also produced immense economic value—crime has cost us billions, but in turn we have gained trillions. Everyone should accept this trade. Had there been security requirements or privacy restrictions at the start of the Internet age, it is very likely that the explosive growth we have seen would not have occurred.

Risk tolerance is dynamic and changes over time, correlating with public perceptions of safety and with greater familiarity with the technology. Perceptions of cyber risk are driven by growing awareness of the number and scope of malicious cyber incidents. These perceptions, however, are too imprecise to serve by themselves as a useful guide for policy, nor are perception improved by anecdotal evidence and discussion of hypothetical situations. We do not know the directions that human inventiveness and market forces will take IoT technology. We do know that over time, with experience and innovation, risk is reduced and new technologies become safer. If the first Internet paid too little attention to security and privacy, we do not want now to overcompensate. Being risk averse makes us poorer, not safer. There is risk in every technology we use. Hold IoT captive to our fears and we will sacrifice opportunity