Back to the Future in Device Security Leveraging FIPPs to Proactively Manage IoT Privacy and Security Risk

摘要

IoT represents great and unpredictable change in the way data are collected, processed, stored and analyzed. New technologies will significantly improve the way companies operate their business and interact with customers and other organizations. In this sense, IoT symbolizes great promise, but it also poses risk to personal privacy and security, including collecting and processing data for new purposes beyond their original intent and generating amplified risk associated with insecure devices and target-rich data sources. To address these issues and challenges, companies must incorporate privacy and security from the outset when looking to adopt, design and deploy new connected technologies. FIPPs represent the foundational elements of many comprehensive risk- and control-based privacy frameworks. Organizations can leverage FIPPs-based frameworks, including GAPP and NIST SP 800-53 appendix J, to evaluate the privacy and security issues posed by new IoT devices, help their organizations design and integrate secure technologies, and reduce their overall risk levels. Although IoT is changing the way data are collected, processed and used, FIPPs contain relevant guidelines for companies to manage privacy and security proactively in the design of new IoT devices.