Martin Walshaw, senior engineer at F5 Networks, looks at some of the unintended consequences of the Fourth Industrial Revolution that we might be heading towards.
You haven’t been feeling well this week. You make an appointment with your doctor, who’s actually a computer that assesses you and writes a prescription for flu medication. You take the prescription to your pharmacist, also a computer that quickly dispenses the drugs. The whole process takes 20 minutes and soon you’re recovering in bed.
The World Economic Forum (WEF) expects the Internet of Things (IoT) to eliminate more than 50-million jobs in the next five years as technology automates more day-to-day tasks. They’re calling it the Fourth Industrial Revolution, which is characterised by a fusion of technology that blurs the line between the physical and digital spheres.
While automation makes life easier in many areas – like not having to wait an hour to see your doctor – it also presents a number of risks.
Privacy versus convenience
Privacy is becoming a luxury for consumers. We use more and more gadgets to monitor our fitness levels, automate our homes, and replace everything from cash to ID cards. More data is being collected about us than ever before. Servers in the cloud know who we are, who we communicate with and are familiar with our habits. But we don’t know who is accessing this information or what they’re doing with it.
When it comes to business, every industry will be affected. The IoT will give rise to entirely new systems of production, management and customer service. Competition will increase; new revenue streams will open up as others slam shut. To survive, businesses will offer more services through convenient web applications, which, if not secured properly, could provide an access point into the infrastructure for cybercriminals.
These unsecured networks and this unprotected data can be used for nefarious purposes. Take the computerised pharmacist as an example. The pharmacy recently activated an application on its website that allows patients to order their medication online. However, the application was not properly secured, allowing a hacker to gain access to the network and compromise all prescriptions. Rather than dispensing paracetamol, the pharmacist gives you penicillin, which you’re allergic to.
By automating more processes, we’re placing our trust in devices and software to do the right thing. This makes security a critical element of the IoT. In recent analysis by McKinsey, it was found that current technology could automate up to 95% of the work of doctors, nurses, paramedics, anaesthetists, aerospace engineers and hundreds of others. Imagine the catastrophic outcomes if any of these systems were to be hacked.
Don’t learn safety by accident
We’re all responsible for security. South Africans are generally security conscious. We install burglar bars and alarm systems to protect our houses; we lock our cars after we park them. Yet, when it comes to our smartphones – arguably the most critical gadgets we own considering the amount of personal information stored on them – security is an afterthought. We don’t think twice about granting applications access to personal information, even if it doesn’t make sense for them to do so – why does a photo-editing app need access to our microphone, for example. Often our devices do not have security software installed and we don’t protect the devices with passwords.
This is one reason why businesses should ensure that any device added to the network has security inherently built in.
As we move further into the Fourth Industrial Revolution, businesses need to protect web applications as the first point of entry into the infrastructure. To do this, they need complete visibility into the network – they need to ensure that whoever is trying to come into the network is allowed to come in, that they are who they say they are, and that they’re doing what they’re supposed to be doing.
Currently, many businesses don’t know what normal looks like when it comes to security because they have not established security baselines. A good place to start is with the OWAST top 10 web vulnerabilities. At the very least, businesses should be protecting themselves against these but this is not happening as some of these vulnerabilities have been on the list for years.
Achieving IoT security does not require network overhaul. It’s likely that businesses already have infrastructure in place to support IoT security; they just need to consolidate their resources and possibly add another tool, such as SSL. An application security expert can assess your network and help you achieve a security baseline.
The Fourth Industrial Revolution will drastically change how we live and work. This change will happen suddenly and possibly without warning. Don’t be caught off-guard. Start treating your devices, networks and digital identity as you would your physical security – we might not be able to tell the difference soon.