The challenge of secure IoT development

We focus here on the concept of IoT systems. This includes not only the integration of multiple IoT products and supporting services for an organization, but also discrete IoT products sold by developers.

Rarely does an IoT product developer bring a single device to market. Instead, offerings include interfaces for mobile applications, cloud services, peer devices, and data services. Often, the IoT product developer maintains the device during operation (such as through a subscription service).

We therefore consider an IoT product itself as a component in a larger system or systems. Product developers should begin adopting a system engineering mindset to understand the risks associated with interactions between multiple components within a system. 

IoT developers must meet market demands, stay up to date with fast-changing technology, keep their products secure, and remain competitive on cost. This is not easy, even for organizations that have extensive security budgets and years of experience with risk management. For development organizations that have only recently begun building connectivity into their products and systems, this is a substantial task.

These developers face a number of challenges, and they must strategically plan how they will meet these.