IoT security - responsibilities --- Insecure IoT devices are presenting a growing problem - default passwords are big part of that. IoT don't end up only at user ends, but also get integrated into other systems, sometimes even critical ones.

On one hand, there is a responsibility of users to secure their devices, as Bennette says. But, awareness is a slow process - and there is no liability for not doing so.

On the other, product vendors should ship the products which are better protected - for instance without a default password (or requiring a passwd change before use, etc). They should embed what is known as 'security by default' - where users can reduce security on their own later if they wish, but the default is higher security. Again, awareness about this takes time, and - while some big vendors are turning to security by default - many smaller companies don't have awareness or incentives to do so. Again, there is no liability for vendors that don't secure their products.

Finally, there are the governments responsible for establishing policies that would make this happen. This may include legal accountability of users or industries, but should preferably be ways to incentivise all of them firstly.

Are there any policies in your countries that try to incentivise users and vendors to secure their smart devices?

Source author: Vladimir Radunovic vladar@diplomacy.edu