IEEE Technology and Society Magazine - March 2020 - 27

rate than individuals have previously
been used to when it comes to personal security. As the threats are not
about physical well-being, there may
be a temptation to take them less
seriously as they may not be a direct
danger to an individual's personal
physical safety. There may also be
a misunderstanding about what
exactly the threat is. This is in part
because individuals may carry over
the mental models for physical security to digital security, which lead
them to have incorrect expectations
about the nature and consequences
of the threats they may face.
However, it is important to take
digital security just as seriously as
one would physical security. This is
particularly relevant in the context
of the smart home. There are two
primary issues with the introduction of smart devices into the home.
The first issue is that the device has
ineffective security, for example the
device is easily hackable. The second, more concerning, issue is that
the device be sufficiently secure, but
users are manipulated into allowing
manufacturers access to more data
than they really want to share.

tants like Amazon's Alexa or Google
be used to access information held
Assistant, data may be sent to proin other parts of the system. This is
cessing centers or may even be
particularly a problem when users
inadvertently sent to contacts [4], [5].
introduce smart appliances such as
When such breaches occur users
vacuum cleaners that have not premay feel betrayed by these devices
viously been considered a security
and reluctant to use them because
threat. These devices are new to
they have built an incorrect mental
the market, readily available, and
model of how the device functions.
cheap. As a result they may not necWhile users are familiar with
essarily be secure [8].
ensuring the physical security of
The most obvious way to address
their homes to protect themselves,
this is to ensure that Internet serdigital security is a relatively new
vice providers have sufficient secuconcept. Despite education on the
rity on the server side. However, the
topic, users may assume a device is
end user and purchaser of smart
more secure than it is because they
home devices has no control over
may not consider how each indithis. What they do have control over
vidual device connected is in their
is ensuring that each device introhome, just that the devices within
duced into the home has sufficient
the home itself are secure (that they
security protocols in place. Howevcannot be easily stolen).
er, this may not always be possible.
Physical security is easier to conIn cases where users want, or need,
template than digital security for
to introduce a new device for which
the majority of users. It is
engrained in society that to
prevent break-ins, homeowners need to lock their
doors a nd w indows. To
Security threats to smart devices
do this, they can purchase
locks and alarms, which
are not just from hacking, but
once in stalled they only
need to maintain. The menalso from a lack of control over
tal model of home security is
data access.
that once purchased, a lock
or an alarm system functions primarily on its own. It
does not need to be regularly reviewed
they are unable to determine the
or updated and its working condition
security level, one potential solution
can be easily checked by sight or
is to introduce a surveillance system
touch. This model can be incorfor the smart devices that will monirectly carried over to digital security.
tor their security status on behalf of
Digital security requires constant
the user.
vigilance. The technology is newer
One such example is the GHOST
and is constantly changing, so users
system which is currently being
of smart devices need to regularly
developed as part of the EU Framecheck for security breaches and
work Program for Research and
updates. Each device provides a
Innovation Horizon 2020 [9]. While
potential entry point into a user's
users cannot guarantee the secuhome network, and the fact that all
rity of individual smart devices, they
devices are interconnected means
can use the GHOST system to conthat without sufficient security for
tinuously monitor and provide feedeach device, any one of them can
back on the security status of their

Case One: A Smart Device is
Safe, but Not Secure
In cases where there the security
provided is insufficient, an issue
occurs because there is a difference
between the mental models of the
user, and the designer of the device.
Users may trust these devices
because they trust the company that
produces them, the designer of the
device, or because they are unaware
of what data may be collected. This
is often complicated by the fact that
many users assume privacy and
security are synonymous. Because
data may be encrypted and safe
from hackers, users may assume
that it is confidential as well. This
isn't necessarily the case. Particularly with voice activated virtual assisMARCH 2020

∕

IEEE TECHNOLOGY AND SOCIETY MAGAZINE

IEEE Technology and Society Magazine - March 2020

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2020