Stuck in Neutral

1. Security concerns still hinder IoT strategies, but
advanced adopters are getting to grips with the
necessary techniques and capabilities
The Economist Intelligence Unit’s Internet of Things (IoT) Business
Index 2020, sponsored by Arm, reveals that IoT adoption has progressed
significantly since 2017, both in companies’ internal operations and
in their products and services. But this progress has come in spite of
lingering security concerns.
Of the 825 executives surveyed for the study, 45% agree that security
and privacy concerns have diminished consumer interest in IoT
products. And 13% strongly agree that these concerns have discouraged
their companies from pursuing an IoT strategy.
This no doubt reflects a string of IoT security breaches that have made
the headlines. Among the most alarming was the story, reported in
December 2019, of hackers harassing an 8-year-old girl in the US via her
family’s smart security camera.
Evidently, any company that seeks to pursue such a strategy must
reassure both customers and internal stakeholders that doing so will not
jeopardise their security, and that IoT devices and the data they provide
can be trusted.
Fortunately, the IoT Business Index survey also reveals that companies
are developing their security capabilities as they progress with IoT
adoption. This article examines how companies are building these
capabilities and the security issues they face along the way.
The IoT Business
Index survey
reveals that
companies are
developing
their security
capabilities as
they progress
withIoTadoption Sponsored by:

2. © The Economist Intelligence Unit Limited 2020
The IoT Business Index 2020:
Securing IoT
2
Many manufacturers are guilty of “basic
violations of good security hygiene” such as
setting the default admin passcode to “1234”
and not requiring the user to change it, Ms
Westerhof says.
Adversaries are often able to hack IoT devices
due to misconfigurations, a lack of passwords
or default credentials. The biggest issue is
misconfigurations, says Mr Taylor. He cites
the example of the Mirai botnet, a network
of compromised IoT devices that hackers used
to launch denial of service (DDoS) attacks.
“Attackers just tried a couple of credentials
and the volume of devices targeted was so big,
it worked.”
IoT security concerns
Much of the complexity of securing the IoT
derives from the computational constraints
of connected devices. This means that
conventional approaches to security
management may not apply, says Katrina
Westerhof, research director at Lux Research.
“IoT security products are, in many cases,
inspired by solutions used in the information
technology (IT) world, but they’re not the
same,” she explains. “IoT devices are often
constrained in processing power, memory,
and battery life, so they can’t support
computationally-intensive cryptography or
hold databases of malware signatures like a
desktop computer can.”
Another issue, says Quentyn Taylor, director
of information security at Canon, is that
IoT devices on a company network can be
forgotten about, adding risk. “That’s when
they can become unpatched, and not
configured by the IT department.”
When it comes to connected products,
security problems may arise when companies
prioritise functionality over security, says Ms
Westerhof. This is not helped by a paucity of
effective network protocols, she adds. “Some
protocols are inherently insecure, prioritising
power savings or other features over security.”
Initiatives such as the UK government’s Secure
by Design, which defines a code of practice for
securing consumer IoT devices, are beginning
to address this. But devices are still hitting the
market plagued by major issues as firms rush
to be first to meet consumer demand.
Approaches to IoT security
The encouraging news from the IoT Business
Index survey is that companies who have
progressed through the IoT maturity curve
have simultaneously developed their security
capabilities. This happens externally at first,
but increasingly within the organisation as
adoption proceeds.
Much of the complexity of
securing the IoT derives from
the computational constraints
of connected devices.
Katrina Westerhof,
research director,
Lux Research

3. © The Economist Intelligence Unit Limited 2020
The IoT Business Index 2020:
Securing IoT
3
When asked what best describes their
company’s approach to IoT security, those
with the highest level of adoption are more
likely to have developed internal expertise
and resources to ensure its safety (see figure 1).
So how are firms developing their IoT
security? In his experience, Mr Taylor says
companies using IoT within the business
are securing it internally rather than looking
outside for help.
“They are doing standard things and saying,
‘[let’s] treat it all like a computer: understand
where the data needs to go to and from;
who owns the data; who owns the updates;
how long will the device be in situ; what’s
the worst that can happen if it gets hacked?’
Based on the answers to those questions,
[they] then start to say, ‘how do I run this?
How do I want this to work?’”
In general, companies haven’t been as
cautious as they should be when
implementing IoT according to Ms Westerhof.
However, she says some firms—particularly
those who are more mature in their IoT
deployments—enforce stricter security
specifications for their devices.
The rate of growth does not appear to be
slowing down, but experts say companies
should not fear IoT. “It is easy to be afraid of it,
but it’s everywhere and you can’t get away
from it,” says Mr Taylor. “You need to deal
with IoT and say, ‘how can I benefit from it?’.”
Figure 1. The maturity curve
Companies become more self-reliant for IoT security as they advance in adoption
(% of respondents)
Source: The Economist Intelligence Unit.
0
20
40
60
80
100
We do not use the IoT
Our use of IoT presents no security issues
We rely on our technology providers to ensure
the IoT equipment they provide is secure
We rely primarily on specialist external advice
to ensure our use of IoT is secure
We have the internal expertise and resources
required to ensure our use of IoT is secure
ExtensiveEarly implementationIn planningIn researchNon-existent
6
12
6
77
10
27
33
12
18
17
36
32
12
4
29
35
27
7
1
55
25
15
4
1

4. © The Economist Intelligence Unit Limited 2020
The IoT Business Index 2020:
Securing IoT
4
Securing the internal use of IoT (ie for
internal equipment and processes) requires
a combination of security specifications for
devices, network-level security solutions,
customisation to fill the gaps and a
security culture within the organisation,
Ms Westerhof explains.
But she adds that “the human and cultural
elements” shouldn’t be understated. “Security
isn’t just IT’s responsibility. This is particularly
important in industrial environments, where
IT and operational technology (OT) groups
don’t really speak the same language but are
seeing their worlds collide.”
Securing IoT is certainly a huge task but
firms are well on the way, especially those
operating in high-risk industries. The landscape
is changing rapidly, and Ms Westerhof sees
artificial intelligence (AI) and blockchain soon
playing a role in IoT security. “AI can detect
potential security incidents without knowing
what it’s looking for, and blockchain can help
with security information across a distributed
network of devices.”
About this article
This article accompanies The IoT Business Index 2020: a step change
in adoption, the latest edition of The Economist Intelligence Unit’s ongoing study of the
IoT and its use by businesses. The study, sponsored by Arm, is based on a global,
cross-industry survey of 825 business executives conducted in October 2019.

5. © The Economist Intelligence Unit Limited 2020
While every effort has been taken to verify the accuracy of this
information, The Economist Intelligence Unit Ltd. cannot accept any
responsibility or liability for reliance by any person on this report or
any of the information, opinions or conclusions set out in this report.
The findings and views expressed in the report do not necessarily
reflect the views of the sponsor.