Certification And Collaboration Key To Closing IoT Security-Perception Gap

When it comes to security today, there’s perception and then there’s cold, hard reality.

Here’s the reality: Cybersecurity Ventures expects global cybercrime costs to grow by 15% per year over the next five years, reaching $10.5 trillion annually by 2025, which is triple the 2015 figure. To get a sense for how pervasive the problem is, Symantec set up a “honeypot” system that detected almost 19 million attacks on its IoT devices in the first quarter of 2020. That’s more than 100 attacks every second of every day, up 13% compared with the previous year.

When it comes to IoT security, most of us are familiar with these types of data hacks. But when it comes to trying to make a dent in those trends, perception is a problem. A new report just released by PSA Certified suggests some positive trends: The vast majority of executives know IoT security is a critical issue they need to address today. In fact, the report, Bridging the Gap, indicates that 90% of technology decision makers believe IoT security to be important to their company, for reasons including product differentiation and legal protections. In addition, 90% agree security will be important to their company five years from now.

But there are more worrying trends: Nearly 90% believe their organizations are either on track or ahead of the pack when it comes to security implementations on IoT devices. This rate is higher for respondents in large organizations compared with smaller companies (1-49 employees), where less than half are satisfied with the level of security expertise in their organizations. In fact, smaller companies tend to struggle with security implementations, when it comes to cost and resources and just the ability to hire security experts into their teams.

These are all significant numbers, but here’s where the disconnect comes in: Less than half (47%) carries out a threat model as part of the design of each new IoT device. Only one in three smaller companies does this. In addition, factors such as upfront cost and potential financial liabilities are challenges in expanding their security efforts.

Key to security is collaboration

Software is considered by far the biggest challenge to secure systems according to respondents, but more and more people acknowledge the importance of rock-solid hardware security. The vast majority, in fact, see a “Root of Trust” as important in their designs. In fact, respondents are starting to value software, chip and device all playing vital parts in the security equation.

Encouragingly, respondents see a path toward more cohesive and coherent industry-wide security, even though many tend to agree that fragmented standards are an issue today. Eighty-four percent see value in the role of industry certification as part of their security efforts and an identical percentage of respondents see value in industry collaboration and cross-market knowledge sharing to improve IoT security. Yet, today, only half use external lab testing as part of their security protocols.

There’s work to be done indeed. PSA Certified offers a framework for securing connected devices, from analysis through to security assessment and certification. The framework provides standardized resources to help resolve the growing fragmentation of IoT requirements and ensure security is no longer a barrier to product development.

PSA Certified consists of a four-step program that guides OEMs through the security design and development process: Analyze, architect, implement, and certify. Adherence to PSA Certified protocols embeds security into the beating heart of products and can protect brands, bolster revenue, enhance a company’s reputation and even act as a key selling point.

As we look to the future of our connected world, it is pivotal to understand the challenges ahead. The inaugural PSA Certified Security Report 2021 takes a look at what is needed today to equip manufacturers with the skills to secure tomorrow.