IoT Security Faces a New Standard

Cybersecurity of Internet of Things applications is moving into a new era, as regulators, customers, lawyers, and procurement officers start demanding proof that IoT-enabled applications and devices are indeed secured. As a result, according to a recent white paper published by ABI Research, the assurance-based approach to assessing the security of IoT-enabled solutions can no longer be relied upon.

This is part of an overall shift in the evaluation of digital security. The claims about the security of a particular product or service should now be backed up with verifiable evidence.

Regulation Is Raising the Bar

The integration of connected devices in business practices is getting deeper, putting more responsibility on the shoulders of the companies to prove that their technology is safe during all the lifecycle stages.

The results of ABI Research indicate an increase in regulatory, legal, and procurement requirements. Companies that acquire the connected technology are getting more and more need to be assured that the measures of protection have been taken into account, not just guaranteed.

In such a way the balance of power shifts from the vendors of technology to their customers.

Trust Must Be Demonstrated

Traditional methods for achieving security usually rely very heavily on policies, certifications, assurances from vendors, and internal review processes. Although this still works, the increasing complexity of interconnected systems calls for better ways of verification.

In the new approach to security, the proof will lie in showing that something is being done and if the security measures are working correctly. It might cover issues such as proving device identity, proving the integrity of software, configuration, access control, and data handling.

This trend is already evident in the IT industry. Hardware security and confidential computing, for instance, are meant to offer more verification of the systems and their workload as opposed to assurances from administrators.

IoT Security Becomes a Business Responsibility

Implications are not just for IT departments. Purchasing departments must understand the security features of connected devices before buying decisions are made. Legal and compliance departments require proof that businesses are in compliance with regulations. Finally, executives require knowledge regarding the security implications of connected devices and services.

It becomes clear how important IoT security is in the context of corporate governance. Security can have an impact on all operations, reputation with customers, compliance with regulations, and even financial performance.

For manufacturers of technologies, there is another implication that becomes clear from the above shift. This is the need to consider security through the entire lifecycle of product delivery.

The Importance of Verifiable Security

ABIR's message comes at a time when there are an increasing number of connections and increasing complexity of digital landscapes within organizations. As these systems grow in significance for organizations, clients would want proof that the technology which they have purchased can withstand any kind of security attacks.

The message emerging here is quite simple: organizations need to see proof rather than promises. Those IoT vendors who are able to explain how security works, show proof, and assist their clients with security information will find themselves in a more favorable position.