IoT Devices Labeled for Better Security and Privacy

This post is also available in: עברית (Hebrew)

The vast majority of people are concerned about the security and privacy practices of their connected IoT devices, and there is a growing need to provide them with this information. Privacy regulations are calling for more transparency in how consumer data is collected and used. Its display could be concise and understandable, akin to a nutrition label on food products.

A team of researchers in Carnegie Mellon University’s CyLab have developed a prototype security and privacy label that checks the security and privacy practices of a new IoT device.

The “nutrition label” it creates performed well in user tests. To develop the label, the team consulted with a diverse group of 22 security and privacy experts across industry, government, and academia.

The team also developed an IoT label generator for manufacturers to use to easily create labels for their devices.

The team’s label consists of a primary layer meant to be displayed on the outside of a device’s box, which conveys the most important information such as the type(s) of data the device collects, for what purpose, and with whom the data is shared. 

By scanning a QR code on the primary layer, consumers have access to a secondary layer of the label online that contains additional information such as how long the device retains data, and how often it is shared. Combined, both layers display 47 different pieces of information about a device’s security and privacy practices.

The team is currently in discussions with IoT device manufacturers and retailers, looking for companies interested in being early adopters of the label. Their goal is for their label to become an industry standard so that consumers would be able to readily learn about privacy and security features of their IoT devices and compare these features across devices, just as consumers compare calories and cholesterol in different food products, according to homelandsecuritynewswire.com.

The study was published in the proceedings of the IEEE Symposium on Security & Privacy.