New research shows that users don’t take the security of their IoT devices seriously.

Almost 88% of people have some kind of IoT device in their household, but almost one in six no measures to protect the devices.

“As the research shows, the more devices people own, the more vulnerable they usually are. Manufacturers surely have to take responsibility for the safety of their products, but users play a big part in their own cybersecurity,” says Daniel Markuson, digital privacy expert at NordVPN.

The survey on IoT devices also showed what cybersecurity habits people in different countries lack, what smart devices they usually purchase, and who, in their opinion, should be responsible for keeping those devices protected.

IoT devices, by their very nature, collect and send information. This might be done securely and for a specific purpose, such as an encrypted message to tell your heating to turn off.

But it might also be leaky, either through bad encryption (or none at all) or through giving away extra information. For example, the internet-connected camera on your front door might let you know when a visitor is there, but, if someone else is watching, it could also reveal when the house is empty, or when children are home alone. In 2020, dozens of Amazon Rings were hacked, resulting in a lawsuit against the company.

“IoT device makers are in a rush to sell the gadgets as quickly as possible,” Markuson adds. “This means that they are shipping them out with the minimum features required for them to function, shortening the development process and cutting costs as much as possible. This is great for device makers, but horrible news for consumers. When things are rushed, they leave huge gaps in security.”

User behavior is just one extra aspect of a potential security vulnerability in light of all the technical and structural issues. Still, there are often simple steps we can all take to improve the security of the devices and networks in our homes or offices.

Overall, the vast majority of us have some kind of IoT or connected devices in our homes, even if it’s just a router. In fact, only 12,3% of the people surveyed did not have any of the listed devices. The UK saw the most prolific use of IoT devices, with only 5% of people saying they had none of the devices in their homes. But they also took the least action against the risks, with almost one in five taking no measures to protect them.

The US showed similar results, with 17% of people with IoT devices taking no protective measures. People in the Netherlands and Canada had the best devices-to-behaviors ratio, although France scored well mostly by having much fewer devices (only 77%).

Forty-one percent of users think that manufacturers should be responsible for the safety of the devices they produce, while 56% see it as their own responsibility. The research shows that the main vulnerabilities users are worried about are deprecation (76%), followed closely by privacy issues (75%) and design problems (particularly encryption) (75%).

Markuson offers some tips for all IoT device owners:

* Look into the privacy issues associated with the devices you purchase. Review tech sites that dig into privacy and security issues or buy certified devices.

* Read the privacy policy and other terms and conditions.

* Create sophisticated passwords. Use a secure password manager in case you forget passwords easily.

* Keep devices patched and up to date. Check if your devices update automatically, and, if not, make sure they are running the latest firmware.

* Turn off features you don’t use. Having unused features running in the background opens up unnecessary vulnerabilities or privacy issues.

* Install VPN on your router.