A researcher from Carnegie Mellon University's CyLab Security and Privacy Institute outlined an effective Internet of Things (IoT) security labeling strategy Wednesday during an IoT security summit with the White House.
Yuvraj Agarwal (pictured), an associate professor in the School of Computer Science's Software and Societal Systems Department (S3D) and the College of Engineering's Electrical and Computer Engineering Department, shared CyLab's latest research into providing information to consumers about the privacy and security of connected devices.
"Consumers have smart doorbells, smart thermostats, voice assistants as well as other IoT devices in their homes, and are growing increasingly concerned about the security and privacy risks," Agarwal said. "We need to provide consumers with readily accessible information to help them make informed decisions about what they bring into their homes."
While IoT devices provide numerous benefits — from improving energy efficiency to helping automate routine tasks — they've also been used to spy on consumers and as steppingstones to much larger infrastructure attacks. Unease about sensitive data being sold or shared with third parties has also heightened.
Despite these growing concerns about the security and privacy of IoT devices, consumers generally do not have access to security and privacy information when making purchase decisions. Legislators have proposed adding succinct, consumer-accessible labels, but they have not provided guidance on what these labels should include.
CyLab faculty and students have been working on this problem since 2018. They have pioneered research exploring how privacy and security factors into IoT device purchase behaviors, investigating what should be included on IoT privacy and security labels, and uncovering whether consumers are willing to pay for products with better security and privacy practices.
