Device and Supply Chain Security

The Internet of Things (IoT) refers to the enormous and growing population of network-connected devices beyond traditional computers and phones — security cameras, smart thermostats, industrial sensors, medical devices — and this category presents a distinctive set of security challenges. Many IoT devices ship with weak or even hardcoded default credentials that users never change, have limited processing power that makes running conventional security software impractical, and, unlike a laptop or server, are frequently deployed and then left running for years with no realistic mechanism for receiving security updates at all. Manufacturers, particularly in a crowded, price-competitive consumer market, have historically had limited financial incentive to invest in the ongoing security maintenance a device needs over its full working life, which has produced large populations of internet-connected devices that are effectively unpatchable from the day they are purchased. Because a single insecure device on a network can serve as an entry point to everything else on that network, the accepted defensive baseline is to treat IoT devices as inherently less trustworthy than general-purpose computers and isolate them onto their own dedicated network segment.