Consumer Internet of Things (IoT) networks, such as smart homes, increasingly contain valuable data and control important household functions. Efforts to build cybersecurity frameworks have focused on enterprise environments, and consumer security issues are not adequately addressed. This paper investigates the fundamental differences between enterprise and consumer environments that need to be taken into account to adjust well-tested enterprise security frameworks like zero trust for a consumer network. We identify variations across four dimensions: network participants, stakeholder means, stakeholder priorities, and the threat landscape. Drawing from this analysis, we propose a definition for consumer zero trust (CZT), as well as tenets intended to guide research toward a complete framework. We apply this new definition to a reference smart home environment to validate the tenets and inform future work that is needed to develop CZT into a truly robust framework for consumer IoT security. This work provides researchers and developers with the first steps towards a foundation for improving privacy, security, and trust in unique consumer environments.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

Consumer Zero Trust: Towards a Principled Adaptation of Zero Trust for Consumer Networks

  • Matthew Bush,
  • Dave McKay,
  • Atefeh Mashatan

摘要

Consumer Internet of Things (IoT) networks, such as smart homes, increasingly contain valuable data and control important household functions. Efforts to build cybersecurity frameworks have focused on enterprise environments, and consumer security issues are not adequately addressed. This paper investigates the fundamental differences between enterprise and consumer environments that need to be taken into account to adjust well-tested enterprise security frameworks like zero trust for a consumer network. We identify variations across four dimensions: network participants, stakeholder means, stakeholder priorities, and the threat landscape. Drawing from this analysis, we propose a definition for consumer zero trust (CZT), as well as tenets intended to guide research toward a complete framework. We apply this new definition to a reference smart home environment to validate the tenets and inform future work that is needed to develop CZT into a truly robust framework for consumer IoT security. This work provides researchers and developers with the first steps towards a foundation for improving privacy, security, and trust in unique consumer environments.