Almost 88% of people have some kind of IoT device in their household yet 12% take no security measures to protect their devices, according to research by cyber-security firm NordVPN.

The research shows that users don’t take the security of their IoT devices seriously, with many taking no measures to protect the devices.

“As the research shows, the more devices people own, the more vulnerable they usually are,” said Daniel Markuson, digital privacy expert at NordVPN. “Manufacturers surely have to take responsibility for the safety of their products, but users play a big part in their own cyber security.”

The survey on IoT devices also showed what cyber-security habits people in different countries lack, what smart devices they usually purchase, and who, in their opinion, should be responsible for keeping those devices protected.

IoT devices, by their very nature, collect and send information. This might be done securely and for a specific purpose, such as an encrypted message to tell the heating to turn off. But it might also be leaky, either through bad encryption or none at all, or through giving away extra information. For example, the internet-connected camera on a front door might let the householder know when a visitor is there, but, if someone else is watching, it could also reveal when the house is empty, or when children are home alone.

In 2020, dozens of Amazon Rings were hacked, resulting in a lawsuit against the company.

“IoT device makers are in a rush to sell the gadgets as quickly as possible,” said Markuson. “This means that they are shipping them out with the minimum features required for them to function, shortening the development process and cutting costs as much as possible. This is great for device makers, but horrible news for consumers. When things are rushed, they leave huge gaps in security.”

User behaviour is one extra aspect of a potential security vulnerability in light of all the technical and structural issues. Still, there are often simple steps users can take to improve the security of the devices and networks in homes or offices.

Overall, the vast majority of people have some kind of IoT or connected devices in their homes, even if it’s just a router. In fact, only 12.3% of the people surveyed did not have any of the listed devices. The UK saw the most prolific use of IoT devices, with only 5% of people saying they had none of the devices in their homes. But they also took the least action against the risks, with almost one in five taking no measures to protect them.

The USA showed similar results, with 17% of people with IoT devices taking no protective measures. People in the Netherlands and Canada had the best devices-to-behaviour ratio, although France scored well mostly by having much fewer devices, only 77%.

Four in ten users think manufacturers should be responsible for the safety of the devices they produce, while 56% see it as their own responsibility. The research shows that the main vulnerabilities users are worried about are deprecation (76%), followed closely by privacy issues (75%) and design problems, particularly encryption, (75%).

Markuson provided some tips for all IoT device owners:

• Look into the privacy issues associated with the devices purchased. Review tech sites that dig into privacy and security issues or buy devices certified by organisations such as ioXt.
• Read the privacy policy and other terms and conditions.
• Create sophisticated passwords. Use a secure password manager in case passwords are forgotten.
• Keep devices patched and up to date. Check if devices update automatically and, if not, make sure they are running the latest firmware.
• Turn off unused features. Having unused features running in the background opens up unnecessary vulnerabilities or privacy issues.
• Install VPN on the router. As International VPN day (August 19) is approaching, it is important to highlight its part in protecting homes’ security. VPNs can help prevent man-in-the-middle attacks by encrypting traffic, covering many of the issues with poor encryption on IoT devices.

The survey was conducted via CINT. A total of 7000 people were surveyed, with 1000 representatives each from Australia, Canada, France, Germany, Netherlands, UK and USA. Participants formed representative samples across gender, age, family situation and income levels.

The questions revolved around which IoT devices people had in their homes, what measures they took to secure them, and whose responsibility they think it is to ensure the security of IoT devices. The survey results were cross-referenced with a new user-focused taxonomy of the main vulnerabilities to which IoT devices are exposed. The timeline and taxonomy were generated through a review of the key literature on IoT security and vulnerabilities, as well as looking at press coverages of major attacks.

Panama-based NordVPN is a VPN service provider used by over 14 million internet users worldwide. It provides double VPN encryption, malware blocking and Onion over VPN.