Uploaded byÁkos Csertán
The (in)security of things
This document summarizes privacy and security considerations related to Internet of Things (IoT) devices and wearables. It notes that IoT devices collect a large amount of user data, which can be valuable but also creepy if used or stolen improperly. It advocates for a privacy by design approach where security and privacy are embedded in products from the start through practices like data proportionality, privacy as the default, end-to-end security, and transparency to build user trust.
More Related Content
Similar to The (in)security of things
The (in)security of things
- 1. THE (IN)SECURITY OF THINGS Privacyand security considerations of IoT and wearables CSERTÁN ÁKOS, I&I MEETUP, BUDAPEST 2015
- 2. HELLO! + I’m apsychologist + No, I don’t know what you are thinking about right now + I’m a UX Designer + All my pictures look awful
- 4. ”COMPLETE DAILY CHALLANGES” ”SEEHOW MANY EGGS YOU’VE GOT” ”STAY CONNECTED WITH LAUNDRY CHORES” ”MONITOR YOUR PROPANE SUPPLY” ”EAT SLOWLY”
- 5. YOU SHARE ALOOOOOT OF DATA
- 6. YOU SHARE ALOOOOOT OF DATA
- 7. DATA IS VALUABLE REMEMBERTARGET, RIGHT?
- 8. AND SOMETIMES REALLYCREEPY THE CURLY FRIES CONUNDRUM, ANYONE?
- 9. IT’S THE NATUREOF THINGS + Check and set temperature + Check and set temperature + What devices are on the network? + How many people live there? + Is anyone home?
- 15. TRUSTING THE WRONGDEVICE… + 8 bit + $5 to buy + $1 to embed + 32 bit + $35 to buy + may be cheaper to embed
- 16. …MADE BY THEWRONG PEOPLE… + Small groups of startuppers… + …with no security background or money for consultancy… + …with a huge time-to-market pressure
- 17. …WITH THE WRONGDATA
- 18. PRIVACY AND SECURITYIS PART OF THE PRODUCT + Security trade-off for usability – NO SUCH THING + Technological security =/= Perception of security + Privacy vs Usability – FAKE DICHOTOMY + Privacy vs Feature development – IT’S CALLED FRAUD, MAN!
- 19.
- 20. PRIVACY BY DESIGN A.K.A.A WAY TO STAY OUT OF THE NEWS
- 21. PROACTIVE NOT REACTIVE +Anticipate privacy invasive events + Specify the goals for your data collection BEFORE you collect + Minimize data collection, find low-data alternatives
- 22. PRIVACY AS THEDEFAULT + Defaults rule by default + Informed consent should be really informed real consent + No action required to secure privacy
- 23. EMBEDDED PRIVACY + Partof the products strategy + Part of the design + Part of the architecture
- 24. POSITIVE-SUM + No trade-offsnecessary + ”Full functionality” includes security and privacy barriers
- 25. END-TO-END SECURITY + Strongsecurity measures are the basis of privacy + Security is not just secure storage but secure destruction of data, too
- 26. VISIBILITY AND TRANSPARENCY +ToS is neither transparent, nor visible + Trust, but verify
- 27. USER-CENTRIC + …or youcan also do it just for the money, but, you know. Don’t.
- 28.
- 29.
- 30.