Van ‘t Schip investigated the interdependencies of all these smart devices around us. After all, every device you bring into your home contains chips and components from different companies. And the software that runs the device is built on many layers of software developed by countless parties, from large manufacturers to small hobbyists. Each of these groups brings their own risks.
Ecosystem
‘Current legislation falls short,’ says Van 't Schip. ‘It still often focuses on individual products, but we need to tackle the entire ecosystem at once. It’s not just about a laptop or a smart vacuum cleaner by itself, but about the entire network of sensors, suppliers and cloud systems connected to it. If you’re tackling the nitrogen problem in a nature reserve, you don’t just protect every tree on its own.’
By failing to take the entire ecosystem into account, a small vulnerability can cause major problems. Van 't Schip: ‘To take down a university, you don’t necessarily have to attack the university itself. You can also exploit a vulnerability in the laptops used by staff to gain access to the network. Those laptops then become a sort of modern-day Trojan horse.’
Only as strong as the weakest link
‘Whether it’s a household, a university or a hospital: your cyber security is only as strong as your weakest link,’ explains Van 't Schip. What happens, for example, if the manufacturer of your video doorbell goes bankrupt and a dubious third party takes over the company?
A great deal of software relies on open-source components. Van ’t Schip says: ‘This has many advantages: there is an active, enthusiastic community of developers worldwide who volunteer to help improve the software. Open source is also incredibly transparent. That’s a godsend: a device uses dozens of different types of software, which in turn rely on hundreds of other software packages. That’s why it’s extremely complex – though necessary – for legislators and organisations to keep track of what’s happening deep within that software chain. We can learn a great deal from open-source software in this regard.’
However, there are sometimes risks here too: ‘We have seen in the past that malicious actors have collaborated on such a project for years, only to ultimately build in a backdoor. But thanks to that transparency, such a thing will, fortunately, eventually come to light sooner or later.’
Consumer expectations
Research by Van ’t Schip and colleagues shows that most consumers look to the manufacturer when it comes to security. ‘They want manufacturers to communicate clearly in the event of a data breach, and for such problems to be resolved quickly. Consumers also expect support throughout the product’s entire lifespan.’
According to the lawyer, steps must be taken to make consumers less dependent on manufacturers. ‘Many devices are so intertwined with apps, online accounts and cloud services that consumers have little control over their own digital security. We need to consider ways in which people can gain more control over their own digital environment, for example by making it easier to disconnect devices from a service or remove them from a digital ecosystem.’