Earlier today the Federal Trade Commission released a report on critical security and privacy issues related to Internet of Things technology. With over 25 billion devices connected to the internet worldwide – a number the FTC expects to exceed 50 billion by 2020 – the FTC’s report proposed security guidelines for manufacturers of IoT devices. According to Chairwoman Edith Ramirez, the FTC hopes that “by adopting the best practices we’ve laid out, businesses will be better able to provide consumers the protections they want and allow the benefits of the Internet of Things to be fully realized.”

As summarized in the FTC’s press release issued today, the FTC’s guidelines for companies developing Internet of Things technology are as follows:

1. “build security into devices at the outset, rather than as an afterthought in the design process;
2. train employees about the importance of security, and ensure that security is managed at an appropriate level in the organization;
3. ensure that when outside service providers are hired, that those providers are capable of maintaining reasonable security, and provide reasonable oversight of the providers;
4. when a security risk is identified, consider a “defense-in-depth” strategy whereby multiple layers of security may be used to defend against a particular risk;
5. consider measures to keep unauthorized users from accessing a consumer’s device, data, or personal information stored on the network;
6. monitor connected devices throughout their expected life cycle, and where feasible, provide security patches to cover known risks.”

These best practices, and much of the rest of the report, are the product of the FTC’s November 2013 workshop, The Internet of Things: Privacy and Security in a Connected World. The workshop brought together technology experts, industry representatives, and consumer advocates to discuss the benefits and risks of IoT technology. Workshop participants identified numerous benefits being provided by current Internet of Things devices, from connected medical devices to smart home appliances and cars. As for risks, three core IoT security risks were identified in the FTC’s report: “(1) enabling unauthorized access and misuse of personal information; (2) facilitating attacks on other systems; and (3) creating risks to personal safety.”