IEEE Spectrum - North American - March 2015 - 55

will likely have higher levels of security, but vulnerabilities a product with the other Internet-linked products in a home. For
example, if a smart door lock uses certificate-based authentiare bound to exist for the foreseeable future.
There are two approaches for securing existing systems. For cation, then the smartphone that communicates with the door
newer products that support software updates or those that are lock must also handle such authentication. Working this all
still being developed, the manufacturer can build a firewall and out in a way that is easy for the consumer to use will take time.
To make the Internet of Things even more secure, product
security capabilities into the product's software. The makers of
gadgets like the Nest thermostat can take this approach. Many manufacturers can integrate a device-management agent into
older systems have communication capability but don't support their products. This piece of software would allow the product
software updates-say, older hospital-monitoring systems and to communicate with a security management system, like the
older factory-control systems. Here it may be possible for con- McAfee ePolicy Orchestrator. The agent would report things like
sumers or the product manufacturer to add a firewall through the failed access attempts and attempted denial-of-service attacks.
"bump in the wire" approach. This refers to
a box sitting between the target apparatus
and the Internet that contains hardware
and software to shield the device from
attack. My company, Icon Labs, makes
such a system, the Floodgate Defender.
Tofino Security and Innominate Security
Technologies offer similar products.
As equipment becomes more secure,
Advance your career and impact your company's
this approach may no longer be needed,
success in 2015 by making a strategic investment
but it provides an immediate solution for
in
training and education. Register for a 1- 5 day
vulnerable items.

Massachusetts Institute of Technology

LEARN FROM EXPERTS AT MIT

enough to
protect the Internet of Things against
hackers. That's because manipulation
isn't the only problem-there's also
eavesdropping.
Data encryption is therefore needed
also. Smart locks and heart pacemakers need strong passwords, the kind
that include letters, numbers, and
perhaps special characters as well.
Even better, products should include
certificate-based authentication-that is,
an electronic document that identifies
an individual, a piece of equipment, or
some other entity addressing the gadget. This technology is used today in
point-of-sale terminals, gas pumps, and
ATMs, and it will likely be incorporated
into future versions of home medical
devices and home security solutions. It
hasn't reached these products yet in part
because manufacturers haven't invested
in the up-front engineering effort necessary to make this kind of security work
with their hardware.
One reason for the lag is the market
itself. These are high-volume, low-margin
products, so the cost of additional memory and a faster processor could make a
product less competitive. Even worse than
cost, though, is the problem of integrating

intensive course and access world-class thinking,
acquire new skills, and bring innovative ideas back
to work. Earn CEUs and a certificate of completion.

a firewaLL, however, isn't

Short Programs - Summer 2015
Topics include:
Biotechnology / Pharmaceutical
Computer Science
Crisis Management
Data Modeling and Analysis
Design, Analysis,
and Manufacturing
› Energy / Transportation
› Imaging
›
›
›
›
›

›
›
›
›
›
›
›
›

Innovation
Leadership / Communication
Radar
Real Estate
Robotics
Systems Engineering
Sustainabilitity
Tribology

USE CODE PE04 AND SAVE 10%
when you register and pay fees by April 15.

To learn more about the courses offered this summer, or to inquire about
having a course customized and delivered at your company location, visit:

http://shortprograms.mit.edu/ieee2015

SPectrUm.ieee.orG

north american

mar 2015

http://shortprograms.mit.edu/ieee2015 http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum - North American - March 2015