IEEE Consumer Electronics Magazine - July/August 2022 - 83

with a minimum understanding of what security
issues they might encounter and teach them
how to avoid such issues. Training and awareness
programs can be initiated by the CE community
that highlights the importance of
personal information and its protection and targeted
toward diverse user groups. Since, the
users are extremely diversified, intelligent training
systems can be used that adapts to a specific
user's profile and delivers customized training
programs. Additionally, users can be equipped
with tools that help determining the safety of an
IoT device. " Privacy tutoring apps " that support
the privacy decisions of a user can be made
available so that the users have a greater control
over the system along with their privacy. Such
apps may also enable the users to have an
insight to the different data being collected, and
what type of inferences are being drawn (inference
layer of SPP framework), thereby putting
the onus on the users with respect to what personal
information they want to control.
Since the user characteristics are varied and
may differ on the usage context also (home IoT
users versus IoT usage in an organization), apart
from specific training programs and recommendations,
a more generic design approach may
motivate the users toward a better cybersecurity
hygiene. Nevertheless, although different
users may have different levels of motivation
toward cybersecurity, yet, implementing short
and easy to use security solutions that need less
efforts from the users maybe more effective,
rather than creating elaborate and complicated
solutions that are difficult to use.
The third recommendation is to " warn the
users. " The IoT systems should be fault tolerant,
i.e., they must be able to defend themselves
not only from network faults, but also
from the varied external attacks. The IoT devices
can have built-in intrusion detection systems
that may act as a first line of defence
against external attacks. Simultaneously, the
users must be made aware of any attacks or
events that happen. For instance, when any
malware infests a large number of IoT devices,
then the other users should be immediately
notified so that they can take precautionary
measures. At the same time, the preventive/
corrective measures to be taken should also
July/August 2022
Figure 5. Human-centric Cybersecurity: Paradigm
shift from traditional cybersecurity chain to a
customizable and flexible approach.
be suggested, e.g., changing of password or
resetting the device. It means that depending
on the scenario, the users must be provided
with sufficient choices as to what action they
can take in the event of a security breach or
privacy invasion (choice layer of SPP framework).
Although the skillset possessed by normal
IoT users cannot be compared to the
professional hackers; yet having a transparent
view toward how data are collected and
shared can greatly help the users and enable
them to make informed decisions.
The IoT systems are complicated, and while it
might not be feasible to share the details of every
transaction that happens in such a scenario,
sharing warning messages and information
related to cyberthreats will definitely help the
users to take proper safety actions. Such warning
messages should be well-crafted, meaning that
they must contain useful information for the
users to take appropriate actions. A very basic
warning message may be ignored, while somebody
trying to do remote login access may be
more helpful to elicit a prompt response. Therefore,
communication messages between the system
and the users are an important aspect, which
must be balanced so that the users are not
annoyed, and at the same time receive all the critical
notifications (communication layer of SPP
framework). Thus, it is evident that future
research must focus on all the three pillars of
cybersecurity that we had presented earlier.
In conclusion there needs to be a paradigm
shift from the current " humans as the problem "
83
IEEE Consumer Electronics Magazine - July/August 2022

Table of Contents for the Digital Edition of IEEE Consumer Electronics Magazine - July/August 2022
