Harvard Business Review just ran an interesting article on the information security aspects of Internet of Things (IoT). Based on the storyline, the smart city initiatives are doomed to fail unless the security of the IoT devices and the systems will be improved. While security of the digital society is obviously a key concern, I am not entirely convinced that relying on the security of individual devices and systems is the best course of action.

The biggest problem with IoT security is that most devices are going to be relatively simple and inexpensive connected things. The bandwidth consumption of these devices should be kept to the minimum to save bandwidth. Yet at the same time, security is supposed to be a continuous process. This involves a party that is responsible for keeping an eye on the various security vulnerabilities that emerge from time to time, and another one to make sure that suitable patches are being prepared and applied on timely basis.

While with smartphones, laptops, and servers, this work has commonly fallen under the responsibility of the device manufacturer, it is largely because they have been able to generate considerable service revenue from this work. Considering the much lower cost of IoT devices, it is likely that only a small percentage of IoT device users will be willing to pay a premium for such a service. Due to this dynamic, even the devices that leave the factory floor in pristine condition, face the risk of becoming compromised over time.

Therefore, it seems to me that looking at IoT device manufacturers as the likely saviours is wishful thinking at best. The business logic just is not there.

So where to look for answers?

When people think about Internet security, they often forget how the security is being taken care off in the physical world. Rather than trying to lock down and protect every single belonging in one’s household, we tend to rely on locked doors and alarm systems that protect the perimeters of our homes. The things we keep in our houses tend to be reasonably secure, so long as the doors are locked properly, and the windows are not left open.

In much the same way, the IoT devices should be placed within the boundaries of protected network environments. While every IoT device will never be secure, the associated risks are well contained so long as the perimeter of each machine network is secure. To provide an analogy, my keys are not secure if I leave them on the table at Starbucks—but if I place them on a desk at the safety of my home, the situation changes completely.

Over the last couple of years, the network industry has developed technologies such as Software-Defined Wide Area Networking (SD-WAN) and Network Functions Virtualization (NFV) that allow new networks and security services to be deployed automatically. Although these technologies are not widely used for this purpose yet, they hold the key for securing smart cities as well as any other IoT use case the world holds in store for us.

That is why I believe that the future of IoT security lies in programmable networks and the service providers that operate them for us.