IEEE Consumer Electronics Magazine - May/June 2022 - 60

Special Section on Consumer, Commercial, and Industrial IoT Security and Resilience
capacity in business. The range of devices
include ubiquitous sensors, actuators, and connected
everyday devices from mundane coffeemakers,
toothbrushes, etc., in the consumer
domain to machinery in manufacturing to medical
implantable devices to safety and security
related critical infrastructure components. This
ever increasing reliance on IoT in home, industry,
and businesses comes with the increased
risk of threats and vulnerabilities both from the
existing attack vectors as well as from the constantly
evolving set of attack arsenal from new
innovations.1 For example, potential attack surfaces
against industrial robots are presented by
Maggi et al.2 with grave consequences of sabotage
to psychical damage.
While IoT is continuing to permeate all parts
of our lives with increasing adoption rates, the
cybersecurity dimension deserves even stronger
efforts and initiatives. A recent McAfee report
puts the hidden cost of cybercrime at $1 T with
more than 50% increase in two years and over
1% of the global GDP.3 IoT technology has
proven to be a low hanging fruit for cybercriminals.
They can be used to attack critical infrastructure,
conduct large scale distributed denialof-service
(DDoS) attacks, steal personal information
with crippling financial consequences or
devastating outcomes in terms of national security
and sovereignty.
In this study, our goal is to present a snapshot
of the current state of the IoT security in
consumer, industrial, and commercial domains.
We elaborate on the background and reasons for
its extreme appeal to the cybercriminals under a
formidable task faced by the cybersecurity
professionals.
The rest of the article is organized as follows:
Section " Background and IoT Definition " provides
a synopsis of the IoT and its elusive definition.
Section " IoT Trends " provides a snapshot
of the state of the cybersecurity, the major
developments, and trends. Section " Unequivocal
Appeal to Cybercriminals: IoT " explains the realities
that make IoT a very attractive target for
malicious actors. Section " Why Is IoT Security
Lagging? " analyzes the toiling efforts of cybersecurity
professionals to counter the aforementioned
relentless and ever increasing attacks.
Potential solutions are discussed in the section
60
Figure 1. Convergence of OT and IT catalyzed by
CPS and Industry 4.0.
" Discussion for Potential Solutions and
Approaches Including Legislation " with concluding
remarks given in the final section.
BACKGROUND AND IoT DEFINITION
The term IoT was coined by Kevin Ashton of
Procter & Gamble in 1999.4 While there is no consensus
on its definition, the one by the Internet
Society5 is concise: " ...network connectivity and
computing capability extends to objects, sensors,
and everyday items not normally considered computers,
allowing these devices to generate,
exchange, and consume data with minimal human
intervention. "
IoT is closely related to operational technology
(OT) devices as well as the information technology
(IT) equipment. OT has traditionally
been used to implement, monitor, and control
industrial control systems from manufacturing
to energy, transportation, logistics, and utilities,
including programmable logic control (PLC),
intelligent electronic devices (IEDs), remote terminal
units (RTUs), etc. as well as embedded systems
and system-on-a-chip (SoC). The main role
of IT has been on data and computing while the
primary responsibility of OT on managing equipment.
With the IT/OT convergence,6
one can
state that IoT emerges as the unifying umbrella
term. Once islands of machinery and equipment
as part of OT, the enhancements from information
and communications technology (ICT)
transform them into connected devices under
the unifying term of IoT. Another closely related
term is cyber physical systems (CPS), where
physical phenomena are controlled and engineered
through interactions and interfacing with
computational components. Figure 1 shows the
IT/OT convergence facilitated by CPS and Industry
4.0 developments.
As can be inferred from this definition, there
is a significant overlap. As meticulously analyzed
IEEE Consumer Electronics Magazine
IEEE Consumer Electronics Magazine - May/June 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - May/June 2022
