Introduction

It used to be common to believe that it is impossible to hack certain things in life; cars, pacemakers or the electric grid. After 20 years of studying and working in security, it has become apparent to me that all technologies can be subverted in one way or another, including those named above. Slowly the wider population is waking up to the problem, and wondering if we are building a bright and bold technological future on faulty foundations and shaky ground.

Ideally, experts would solve this problem, much as digital archivists work to solve a problem for society so that everyday folks can get on with their business. The strategic problems in security and privacy are similar though: we don't have enough trained people to care about these issues, we don't have clear educational paths into our profession, we're chronically underfunded, and even when we're not, money is continually re-prioritised to address other risks that align better to a quarterly profit cycle.

All of this was true before and is still true as the Internet of Things enters common parlance. Let's turn our thoughts to the Internet of Things: what has changed in security therein, and then examine some of the impacts of this slowly accruing risk.

Security

At its core, the Internet of Things is ‘ubiquitous computing’, tiny computers everywhere – outdoors, at work in the countryside, at use in the city, floating on the sea, or in the sky – for all kinds of real world purposes. It might be a home automation system that starts your coffee when you wake up in the morning, or agricultural infrastructure such as an irrigation system that applies water at the best time of day to avoid evaporation and conserve water. It might help manage traffic flows in a city to optimise driving time in certain neighbourhoods. Microphones may be used in high crime areas to triangulate gunshots to improve police response times. All of these purposes initially seem logical, and even business critical to the users, yet each of them involves decisions about security and privacy with incredibly longlasting and far-reaching implications. The coffee maker may be used to penetrate your home network. The agricultural system might be hacked in a regional water dispute and used to destroy crops and manipulate prices.