Small Business Strategy for the Internet of Things

Tony Anscombe

February 23, 2016

	Not rated
	Rate:

There will be 6.4 billion "things" connected to the internet this year, up 30% from 2015 - that's according to Gartner, the world's leading information technology research and advisory company. Juniper Research predicts 38 billion while Cisco predicts 50 billion by 2020.

The rate of growth is no less astonishing than the variety of devices being connected. From business laptops, tablets, printers and mobile phones to watches, thermostats, fridges, mattress covers, kettles, a garden(!), cats, dogs and cows. They're all connected to the internet and busy capturing data.

Humans are being connected too, literally. Hannes Sjoblad, the Chief Disruption Officer at Epicenter in Stockholm, Sweden, has had a near field communication (NFC) microchip implanted under his skin. It lets him swipe into his office, set the alarm system, register loyalty points at nearby retailers and access the gym.

Whichever prediction you might choose to go along with, or whichever device tickles your curiosity, the explosion of device connectivity should not be ignored by businesses of any shape or size.

The opportunity and risks for business

For businesses, the opportunity is clear but evolving. Connecting more business devices to the internet will allow them to learn more about how they operate and how their customers buy, interact with and consume their products and services. More data, more insight.

With more data at their fingertips, businesses will have the chance to identify operational efficiencies as well as sales and service opportunities. But while this influx of data will help build a deeper understanding of a business, there are a number of risks to address: some are clear and known, others are evolving and uncertain.

Two questions should rise immediately to the top of the business agenda: the first concerns whether or not connecting a device to the internet will deliver the desired insight and do so cost-effectively. The second: if a device is connected, how will that connection be implemented and managed? The first question defines the opportunity and risks, but the second question is critical from a business continuity and risk management perspective; adding more devices to a company's IT network increases its "security perimeter" and the effort and resources required to monitor and protect it.

The Internet of Things is much more than Bring Your Own Device

As Tony Anscombe, Senior Security Evangelist for AVG Business, a provider of security solutions worldwide, gives an example, “Employees are increasingly using their personal smartphones to access business data from many different locations. But soon they could also be using their smartphones like remote controls to manage other connected devices within their working environment: thermostats, door entry systems, lights, printers and even kettles in the communal kitchen. It sounds convenient, but all these devices have the potential to give up the office WiFi password the same as an employee's smartphone or laptop can. Each connected device creates a potential entry point for a hacker to gain access to other more important devices and business systems.”

Employees might also have personal medical devices embedded within their own bodies, a smart pacemaker for example. While such a device might initially appear to have nothing to do with an employee’s role or tasks at work, they can be exploited like any other connected device whether they’re at home, work or on holiday.

Anscombe continues “Cyber criminals are constantly probing hardware and looking for flaws in software to exploit. They’re scanning the airwaves and harvesting passwords and other personal identity data from wherever they can. My advice is simple: every connected device, be it company-owned or an employee’s personal device being used for work, needs to be included in your strategic business-wide security plan. If you’re aware of it, you can mitigate the associated risks.”

If it's thought a connected business device could deliver valuable insight regarding how employees are performing - with a view to optimising their workloads, processes and performance - it's also important to consider how that initiative is communicated to employees. Those devices are not always welcome, as the staff at the Daily Telegraph were quick to, and very publicly, reveal.

Making sense of the emerging trend

It's also important for businesses wanting to take advantage of the Internet of Things (IoT) to recognise its emerging and evolving character, and understand how that can affect business decisions.

There is no universally agreed approach to creating, implementing, maintaining or developing the global, national or local infrastructure needed to support the billions of devices to be connected. Neither is there a single agreed approach to managing data and device security.

There are instead a multitude of organisations and companies developing standards, devices, software and infrastructure, all competing to be the dominant force in their specific market. This can make it hard for businesses to gravitate towards a particular solution because it's unclear which standards, products and services are being - or will be - securely developed, widely adopted and well supported.

In spite of this inherently unstable aspect to the Internet of Things, businesses can still apply some rigor to their decision making and mitigate the worst effects of a rapidly evolving market place:

Five things to consider

From both a strategic and risk management perspective, any business would do well to ask the following questions when considering the value of connecting a device, or series of devices, to the internet:

Will the device collect data that will actually benefit the business, and how much analysis is required to make sense of it?
What is the likely return on investment and will that outweigh the costs and risks?
How will the device be implemented and managed: is this going to be seen as more work for the IT department, or if there is no IT department then who will take on that responsibility?
Which areas of the business and personnel will have access to the data and device, for what purpose and under which conditions?
To what extent, and in what ways, will this device and data impact productivity and working culture?