What Makes IoT Secure? A Maturity Analysis of Industrial Product Manufacturers’ Approaches to IoT Security

Abstract

AbstractThe Internet of Things (IoT) carries enormous potential but also exposes products to new security threats. Even though recent years have seen several costly breaches and security experts advocate for a more proactive approach, security is often not up to par with technological innovations. But why is this so? Whereas a lot of research has been dedicated to describing technical security issues, there is a lack of research into product manufacturers’ practices of securing IoT; what challenges do they face in developing, manufacturing, and selling secure IoT products, and what resources do they have for overcoming them? Without knowledge of these empirical perspectives, initiatives to further IoT security grope in the dark.Employing a theory of change to unfold organizational aspects of IoT security, this paper seeks to explore the socio-technical factors that shape IoT security in practice. Based on a qualitative interview study with 52 informants from 26 companies making products for industrial enterprises and critical infrastructures, this paper not only offers insights into the real-world challenges in working with IoT security, but also presents a maturity model based on three necessary conditions for companies’ ability to handle IoT security.KeywordsInternet of ThingsIoT security in practiceOrganizational maturityInterview studyMaturity analysis