Analysis

Why data security isn’t child’s play

Worrying flaws in VTech and Barbie show companies still aren’t taking security seriously

Security in the Internet of Things (IoT) is a contentious subject.

From killer fridges and toasters to connected thermostats that will turn your heating right up or right down, there is no shortage of scare stories, yet it seems when it comes to devices aimed at children, basic security is being overlooked.

Most recently, toy makers VTech and Mattel have been in the news having respectivelysuffered a massive data breach and a proof-of-concept for a hack on a connected Barbie, but they are far from the only victims.

Baby monitors have proven to be particularly vulnerable to hacking, being used by Peeping Toms and people who, for reasons known only to them, want to shout abuse at infants (Buzzfeed has created a list of some of the more egregious examples).

What this exposes is a complete dichotomy in our attitude towards internet security and one of the most vulnerable sections of our society.

On the one hand, great attention is paid to the material children could come across while browsing online, particularly pornographic or violent material, or sexual predators. And yet, when it comes to connected devices aimed at children, normal protective sensibilities seem to be forgotten.

"We're often too excited about what we can connect to the Internet of Things, instead of whether or not we should connect it," Chris Boyd, malware intelligence analyst at Malwarebytes, tellsIT Pro.

"Where children are concerned, I do wonder if toy manufacturers employ individuals sufficiently versed in security to be able to raise possible issues with new toys rolling out of the factory."

Mark Painter, security evangelist at HP Enterprise, agrees.

"Toy manufacturers are following the same playbook as every other kind: functionality and time to market over security concerns. Security is simply an afterthought until stories like the VTech and Barbie hacks push it to the forefront," he says.

"It's a hard world when parents have to limit what toy their child can play with because of security vulnerabilities, but it's the one we now inhabit," Painter adds.

What can be done?

There is no silver bullet in security, and protecting connected toys is no different. Indeed, the IoT is a fast-evolving sector, with many organisations both old and new introducing smart features to products that have traditionally had no communications function or, perhaps, not even any electronics.

However, these manufacturers need to fully realise their new responsibilities within the connected world.

"Hopefully these scares will wake up toy developers before the next generation of toys are developed - ones that could conceivably have the ability to cause some type of physical damage," says Painter. "We're just not that far away from what would have seemed like science fiction not even five years ago."

But as always, there is an element of responsibility that lies with the user - or in this case the user's parents.

As with routers, the passwords for monitoring devices should be changed and not left on the default. There is also an element of self-education, though, and 'buyer beware'.

"It's still an incredibly important issue for parents to be aware of, and when making a purchase they should definitely look at Internet features on the back of the box and think 'What could possibly go wrong with this?'," says Boyd - something that, particularly in the run-up to Christmas, should perhaps be more on parents' minds than ever.

Featured Resources

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Evaluate your order-to-cash process

15 recommended metrics to benchmark your O2C operations

Download now

AI 360: Hold, fold, or double down?

How AI can benefit your business

Download now

Getting started with Azure Red Hat OpenShift

A developer’s guide to improving application building and deployment capabilities

Download now

Recommended

Weekly threat roundup: SAP, Windows 10, Chrome
vulnerability

Weekly threat roundup: SAP, Windows 10, Chrome

21 Jan 2021
Biden nominees highlight tough cyber security challenges
cyber security

Biden nominees highlight tough cyber security challenges

20 Jan 2021
Report: Security staff excluded from app development
cyber security

Report: Security staff excluded from app development

20 Jan 2021
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

20 Jan 2021

Most Popular

Citrix buys Slack competitor Wrike in record $2.25bn deal
collaboration

Citrix buys Slack competitor Wrike in record $2.25bn deal

19 Jan 2021
How to recover deleted emails in Gmail
email delivery

How to recover deleted emails in Gmail

6 Jan 2021
SolarWinds hackers hit Malwarebytes through Microsoft exploit
hacking

SolarWinds hackers hit Malwarebytes through Microsoft exploit

20 Jan 2021