Securing Your Internet of Things Devices

It's been said that "the safest computer is one that isn't connected to the Internet." There's a certain truth to that statement; however, in today's ever-more-online world, it's a pretty pointless platitude. And when you're talking about the Internet of Things, it's a contradiction in terms. By definition, your device must be connected to the world to do its job properly – and that means security is a very real consideration. Fortunately, many of the same rules that apply to security in general will be applicable to your IoT devices.

Strong Passwords

This should go without saying, but it cannot be stressed enough. Any passwords, keys, access tokens, etc., used by your devices should be as strong as possible. Randomly-generated passwords are best, and should use a mix of character types. Longer is always better. Most importantly, keep them secure. Don't treat your digital keys with any less care than you'd give your physical keys.

Limit Your Attack Surface

In the context of computer security, "attack surface" refers to the different ways an attacker might try to infiltrate your system. Think of your device like a house: having lots of doors and windows might be more convenient at times, but it also makes you more vulnerable, because someone who can't get in the front door can try around the side, or the back. In the same way, your device should have as few "doors" as possible. Just because it came configured a certain way doesn't mean that it's secure! Many times, there will be unnecessary servers, services, and ports running that could provide attackers a way in. If you don't need them, close them down.

You may also want a properly-configured firewall. A firewall can inspect the various communication coming and going from your devices, and can often prevent malicious activity by blocking it entirely. If, for example, you know that your devices will be managed by a central server with a static address, you can configure it to completely deny traffic from any other source, thus adding a layer of security.

Encryption

Even if you're certain that your device isn't compromised, you can't always ensure the safety of your data as it travels through the Internet. An average data packet might pass through dozens of different routers on its way across the world; any one of those could be surreptitiously "sniffing" your data – or worse, changing it. The best way to handle this is end-to-end encryption, based on a strong, well-tested library. Some people like to try and "roll their own" encryption, but this is a recipe for disaster. It's very easy to write a crypto library that seems secure, but actually has design flaws making it trivial to defeat. There are multiple encryption algorithms and libraries, many of them completely free and open-source, that can be used to keep your information secure.

Obscurity is Not Security

"Nobody would ever want to attack us" is not a security policy! Even the simplest project from the smallest client should consider the possibility of attacks. There's no good excuse for not taking care with your devices and your data, and Smart Software can help ensure you're taking the right steps to stay secure on the Internet of Things.

Want to Learn More?

This is just a sample of what we can do. We have 15 years of experience working in nearly every technology and industry. Whatever you are doing, we've done it and are prepared to tackle your project. Reach out and we will discuss it with you.