<abstract xmlns="http://www.w3.org/1999/xhtml">

Internet of Things (“IoT”), specifically in the consumer space, describes an environment where consumer devices, connected to the Internet in a smart home, communicate to each other directly or through the cloud. Cheap manufacturing and a fast-growing market brought billions such devices in everyday homes, and consequently new concerns emerged about their security.
The complexity added by these new systems, with fragmented in-house hardware and software platforms, have been recently the target of both scrutiny and controversy.
When IoT devices get hacked it’s no longer just “script kiddies” and part-time hackers, it’s state actors and national security on the line.
Where for PCs there is a robust cybersecurity product market (eg. “antivirus”), the majority of IoT devices in households are designed with little or no regard towards cybersecurity and the typical consumer’s understanding of how to secure these is lacking.
Effective ways to safeguard IoT products are bug bounties, programs that offer a financial reward to anyone discovering vulnerabilities, but they are costly and hard to manage, thus usually adopted by more mature companies.
All manufacturers can additionally benefit from responsible vulnerability disclosure, or ethical hacking, where researchers attempt to find vulnerabilities for recognition or as a public service.
Unfortunately disclosing and coordinating vulnerability research challenges are downplayed.
This paper proposes to investigate impact, discuss time considerations, and suggest potential solutions for consumers, companies, and regulators to mitigate and improve IoT vulnerability reporting, fixing and disclosure.
</abstract>

Internet of Things (“IoT”), specifically in the consumer space, describes an environment where consumer devices, connected to the Internet in a smart home, communicate to each other directly or through the cloud. Cheap manufacturing and a fast-growing market brought billions such devices in everyday homes, and consequently new concerns emerged about their security.
The complexity added by these new systems, with fragmented in-house hardware and software platforms, have been recently the target of both scrutiny and controversy.
When IoT devices get hacked it’s no longer just “script kiddies” and part-time hackers, it’s state actors and national security on the line.
Where for PCs there is a robust cybersecurity product market (eg. “antivirus”), the majority of IoT devices in households are designed with little or no regard towards cybersecurity and the typical consumer’s understanding of how to secure these is lacking.
Effective ways to safeguard IoT products are bug bounties, programs that offer a financial reward to anyone discovering vulnerabilities, but they are costly and hard to manage, thus usually adopted by more mature companies.
All manufacturers can additionally benefit from responsible vulnerability disclosure, or ethical hacking, where researchers attempt to find vulnerabilities for recognition or as a public service.
Unfortunately disclosing and coordinating vulnerability research challenges are downplayed.
This paper proposes to investigate impact, discuss time considerations, and suggest potential solutions for consumers, companies, and regulators to mitigate and improve IoT vulnerability reporting, fixing and disclosure.

Improving Internet of Things Vulnerability Disclosure and Coordination

Proceedings of the International Conference on Business Excellence

This work is licensed under the Creative Commons Attribution 4.0 International License.

{"article-title":"Improving Internet of Things Vulnerability Disclosure and Coordination"}

Internet of Things (“IoT”), specifically in the consumer space, describes an environment where consumer devices, connected to the Internet in a smart home,...

Improving Internet of Things Vulnerability Disclosure and Coordination

Online veröffentlicht: 14. Juli 2023

Seitenbereich: 959 - 968

DOI: https://doi.org/10.2478/picbe-2023-0087

Schlüsselwörter
Internet of Things, Cybersecurity, Smart Home, Bug Bounty Programs, Ethical Hacking, Vulnerability Management, Vulnerability Disclosure

© 2023 Dan-Radu Berte, published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

Improving Internet of Things Vulnerability Disclosure and Coordination

Online veröffentlicht: 14. Juli 2023

Seitenbereich: 959 - 968

DOI: https://doi.org/10.2478/picbe-2023-0087

SchlüsselwörterInternet of Things, Cybersecurity, Smart Home, Bug Bounty Programs, Ethical Hacking, Vulnerability Management, Vulnerability Disclosure

© 2023 Dan-Radu Berte, published by Sciendo

This work is licensed under the Creative Commons Attribution 4.0 International License.

Schlüsselwörter
Internet of Things, Cybersecurity, Smart Home, Bug Bounty Programs, Ethical Hacking, Vulnerability Management, Vulnerability Disclosure