The IoT and Security: 3 Strategies Every Pro Must Know

Law enforcement and security professionals can benefit from the IoT — and not just to watch people more closely. Follow these three steps to prepare for the IoT reality, protect your own vulnerabilities, and find creative solutions to your investigative problems.

• By Danny Boice
• Sep 04, 2017

We’ve already seen the impact of technology and social media on investigations, but for the Internet of Things, that impact is just beginning.

Police and private investigators have used location metadata from photos to track people down, but imagine how much more information they can gain from all the smart devices on the market today. Gadgets like Nest thermostats, internet-accessible refrigerators and other smart home devices are collecting data that can tell security staff more about people’s daily habits, including when they are (or aren’t) at home.

Police are currently being trained to check the data from these devices during investigations, as it can provide valuable information about alibis, witness statements and even the crime scene itself. As the IoT continues to develop, understanding how these interconnected devices handle user data will become critical to investigative work.

Changing the Landscape

Investigative techniques that involve open-source intelligence channels, such as deep web searches, could soon be more effective as people increase their IoT footprints. However, as these devices collect more data, they are also becoming more sophisticated and secure.

No longer will it be possible to simply seize a device to secure the data it holds or even to seize the server that it is communicating with. Cloud computing and widespread adoption of encryption have made information retrieval more difficult for anyone other than the intended user, which can frustrate investigators. As the IoT grows, these challenges will only become more widespread.

Digital forensics teams are working on ways to tackle this problem, but leveraging the IoT during investigations still poses significant challenges. Digital forensics specialists need to understand basic network types, such as Wi-Fi and mobile, as well as cloud storage, sensors, and RFID tech. Because IoT technology is a combination of many different tech areas, IoT forensics are more complicated than traditional forensics.

Despite the challenges, investigators must strive to understand the rising role of the IoT and how they can leverage the technology to their advantage.

Adapting to New Surveillance Strategies

Surveillance today is as much about creativity as it is about technical knowledge and staying aware of industry developments. So many connected devices are either unsecured or poorly secured, so using these devices to watch, track, and listen requires knowing what they are and thinking of new ways to use them.

Samsung’s smart TVs, for example, house microphones that were (until a recent fix) always on. Other poorly secured devices could be an investigator’s gateway into an otherwise airtight personal network. These vulnerabilities represent methods to conduct surveillance that require only a subpoena or other court order to tech vendors, which was impossible before the rollout of IoT devices.

As the IoT expands, the security industry is responding by turning away from physical tactics in favor of software surveillance and communications encryption. That doesn’t mean all investigators will need to become hackers to keep their jobs; it simply means they will need to understand the possibilities within the new landscape and how they can take advantage of their expanding tool kits.

How to Prepare for the New IoT Reality

Law enforcement and security professionals can benefit from the IoT — and not just to watch people more closely. Follow these three steps to prepare for the IoT reality, protect your own vulnerabilities, and find creative solutions to your investigative problems:

1. Improve Resource Usage

Investigators can leverage data from IoT devices to maximize their resources. Machines can collect and analyze data to tell officers and investigators where they need to be and where trouble is most likely to happen.

That can mean deploying patrol cars to gunshot locations or using data from a smart thermostat to see when suspects leave home, which allows law enforcement and investigators to make better use of their time and resources and be at the right place at the right time more often.

2. Identify Security Gaps

Security professionals get targeted by the bad guys too. IoT devices make life easier, but when managed improperly, they can also create gaps that compromise evidence or endanger an investigation.

To make the most of IoT technology and ensure it’s used properly, security staff should understand secure device management and how to mitigate risks. Keep your devices updated to limit your exposure to harmful hacks — such security gaps could compromise evidence or endanger an investigation, so it’s especially crucial that your data and information are protected.

3. Make Current Tools More Efficient

Beyond exploiting the vulnerabilities in suspects’ IoT devices, investigators can use their technology to improve existing tools and make them more cost-effective.

For example, modern security cameras can interact with smartphones from any location to record footage or change perspective. That allows investigators to be in several places at once without being obvious.

You do not have to be a programmer to make the IoT work for you. With a little effort and creativity, you can improve the success rate of your investigations and stay ahead of the technological curve.