Introduction to Consumer IoT Security

The Consumer Perspective of IoT Security

Many People Assume a Connected Home Product Is Secure Because It Is on Sale

Research conducted for DCMS highlights a common problem – people think a product is secure because it is on sale. Almost three-quarters (72%) of respondents to a survey about the labeling of IoT devices said they assume security has been built in ‘when the product comes to market’.

Unfortunately, there are many high-profile examples that demonstrate this is not always the case. That means buyers are relying on manufacturers and retailers to do the right thing and the trust they are placing in them could be eroded if they are the victim of a cyberattack.

Who Is Responsible for Securing IoT Devices?

Consumers may want peace of mind but who is responsible for providing it? A separate DCMS report into people’s attitudes towards device security, particularly since the coronavirus pandemic, suggests the whole ecosystem needs to work together to build people’s trust in the IoT. Eighty-four percent of the consumers surveyed believed companies in the supply chain should be responsible for checking and being aware of the cybersecurity features of a device before it goes on sale. Almost nine in 10 respondents (87%) thought smart devices should have basic security features built-in as a way of protecting people’s privacy and security.

So, what do technology decision-makers think? They also believe we all have a role in securing the IoT. More than half of consumer IoT survey respondents (58%) said individual companies should show initiative and protect consumers from vulnerabilities.

What Does a Secure Device Look Like?

How do consumers know what products have security built-in? Currently, there is no consistent information to inform their decision-making. There is no agreed form of wording, rating system, or logo to point people in the direction of trustworthy products and this lack of clarity makes it hard for them to buy with confidence.

In fact, 83% of our survey respondents said they look for specific security credentials when they are buying IoT devices for themselves, and almost as many (76%) do so when they are buying for their company. However, more than two-thirds (68%) admitted they do not know what to look for in the latter case.

As an industry, we must get better at communicating with customers about security in a way that is easy to understand.

Navigating Security Standards to Access Global Markets

In many regions, governments and standards organizations are stepping in to protect consumers from insecure products and to offer guidance to device makers on basic security requirements. However, meeting all standards, requirements, and regulations can be challenging, especially if a device maker ships products globally.

Security Is Complex, Requires Expertise and Is Time Consuming

All of this can also make security feel complex and time-consuming, particularly if companies do not have access to dedicated security specialists. Just 31% of companies are very satisfied with the level of security expertise within their company and the World Economic Forum estimates that there is a gap of more than 3 million security experts worldwide. This exacerbates concerns that difficulties in implementing the right security for a device will increase time to market- something that is particularly true for smaller organizations.

The Cost Paradox

As more consumers value security an increasing number of technology leaders are also realizing its benefits. Almost all respondents to our survey (96%) said securing their IoT products positively affects their company’s bottom line. More specifically, many (52%) said people are more likely to trust their company, and therefore, buy their products. Others (30%) reported being able to charge more for their devices because they are secure.

It means the costs of insecurity are starting to outweigh the costs of investing in appropriate protection, and yet, our Security Report also shows the cost of implementing security is still one of the reasons many IoT product developers overlook it. Their challenges include the costs of security expertise and independent testing and certification.

Assuring Consumers Their Devices Are Secure

Even if security is a priority, many developers of IoT products realize consumers may not trust the claims they make about their products without third-party verification. Independent verification also enables manufacturers to build their products on secure and trusted components. 95% of people who responded to our survey agreed– they said security certification was at least somewhat valuable to ensuring a secure IoT.