Analysis

Why data security isn’t child’s play

Worrying flaws in VTech and Barbie show companies still aren’t taking security seriously

Security in the Internet of Things (IoT) is a contentious subject.

From killer fridges and toasters to connected thermostats that will turn your heating right up or right down, there is no shortage of scare stories, yet it seems when it comes to devices aimed at children, basic security is being overlooked.

Most recently, toy makers VTech and Mattel have been in the news having respectivelysuffered a massive data breach and a proof-of-concept for a hack on a connected Barbie, but they are far from the only victims.

Baby monitors have proven to be particularly vulnerable to hacking, being used by Peeping Toms and people who, for reasons known only to them, want to shout abuse at infants (Buzzfeed has created a list of some of the more egregious examples).

What this exposes is a complete dichotomy in our attitude towards internet security and one of the most vulnerable sections of our society.

On the one hand, great attention is paid to the material children could come across while browsing online, particularly pornographic or violent material, or sexual predators. And yet, when it comes to connected devices aimed at children, normal protective sensibilities seem to be forgotten.

"We're often too excited about what we can connect to the Internet of Things, instead of whether or not we should connect it," Chris Boyd, malware intelligence analyst at Malwarebytes, tellsIT Pro.

"Where children are concerned, I do wonder if toy manufacturers employ individuals sufficiently versed in security to be able to raise possible issues with new toys rolling out of the factory."

Mark Painter, security evangelist at HP Enterprise, agrees.

"Toy manufacturers are following the same playbook as every other kind: functionality and time to market over security concerns. Security is simply an afterthought until stories like the VTech and Barbie hacks push it to the forefront," he says.

"It's a hard world when parents have to limit what toy their child can play with because of security vulnerabilities, but it's the one we now inhabit," Painter adds.

What can be done?

There is no silver bullet in security, and protecting connected toys is no different. Indeed, the IoT is a fast-evolving sector, with many organisations both old and new introducing smart features to products that have traditionally had no communications function or, perhaps, not even any electronics.

However, these manufacturers need to fully realise their new responsibilities within the connected world.

"Hopefully these scares will wake up toy developers before the next generation of toys are developed - ones that could conceivably have the ability to cause some type of physical damage," says Painter. "We're just not that far away from what would have seemed like science fiction not even five years ago."

But as always, there is an element of responsibility that lies with the user - or in this case the user's parents.

As with routers, the passwords for monitoring devices should be changed and not left on the default. There is also an element of self-education, though, and 'buyer beware'.

"It's still an incredibly important issue for parents to be aware of, and when making a purchase they should definitely look at Internet features on the back of the box and think 'What could possibly go wrong with this?'," says Boyd - something that, particularly in the run-up to Christmas, should perhaps be more on parents' minds than ever.

Featured Resources

Digital document processes in 2020: A spotlight on Western Europe

The shift from best practice to business necessity

Download now

Four security considerations for cloud migration

The good, the bad, and the ugly of cloud computing

Download now

VR leads the way in manufacturing

How VR is digitally transforming our world

Download now

Deeper than digital

Top-performing modern enterprises show why more perfect software is fundamental to success

Download now

Recommended

Bank-targeting malware disguises itself as video conferencing software
Security

Bank-targeting malware disguises itself as video conferencing software

19 Oct 2020
What is shoulder surfing?
Security

What is shoulder surfing?

19 Oct 2020
Google blocked record-breaking 2.5Tbps DDoS attack in 2017
Security

Google blocked record-breaking 2.5Tbps DDoS attack in 2017

19 Oct 2020
Microsoft releases two emergency Windows patches
Security

Microsoft releases two emergency Windows patches

19 Oct 2020

Most Popular

The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

5 Oct 2020
iPhone 12 lineup official with A14 Bionic chip and 5G support
Mobile Phones

iPhone 12 lineup official with A14 Bionic chip and 5G support

13 Oct 2020
Google blocked record-breaking 2.5Tbps DDoS attack in 2017
Security

Google blocked record-breaking 2.5Tbps DDoS attack in 2017

19 Oct 2020