Stacey on IoT | Get gold-level security

First up, let's talk about Helium's history and business model. The company was created in 2013 because its founders realized that the internet of things was promising, but also tough to implement. If you wanted to make connected sensors useful and ubiquitous you had to make connected sensors easy to install and cheap to operate. Which is why when Helium first launched it was building a proprietary radio protocol embedded in sensors.

Haleem's insight was that LPWANs for the internet of things needed to be plentiful and cheap. If you charge a lot of money to send relatively small amounts of data you'll only get high-end use cases, such as tracking diamond shipments or whatnot. And there are plenty of existing networks—including cellular—that meet that need. What the IoT needed was a way to send small amounts of data at low power for a penny or so per transaction. 

That way if a company wanted to connect a smoke detector to the internet, it could afford to do so in a manner that wouldn't make the device cost-prohibitive, or require the manufacturer of the smoke detector to create a subscription plan simply to pay for data. The cellular industry is trying to build a low-cost network for IoT on traditional licensed spectrum called NB-IoT. Other companies, such as Sigfox and Senet, are also trying to build low-power IoT networks from scratch. 

But Haleem's contention is that if the goal is to try to connect a bunch of data-sipping, low-cost devices to the network, the cost of building a centralized network is simply too high. Instead, the network must be decentralized and look more like a shared, user-created network.

And so both the Helium hotspot and Helium token network were born. Haleem hopes that users will install Helium's physical routers on their broadband networks to create an ad hoc IoT network that will transfer data over those users' home or office broadband connections. To incentivize users and create security, Helium created a blockchain called Helium Network Tokens that accrue to people who run a Helium hotspot.

Helium hotspot owners can earn tokens for providing a connection to passing devices as well as for simply existing as a node on the network. For now, Helium Tokens are exchanged for data credits, which allow your devices to surf on the Helium network. In early March, Helium announced that it would add LoRa support for its network, which was a big deal for the company, because at that moment the network became useful for hundreds of existing sensors and devices already in the world. 

It also meant that more people would have an incentive to buy or build a hotspot for the Helium network, because there was now more demand for such a network. For me, it meant that suddenly my Hotspot would get more pings, earning me more tokens.

So now let's talk about the Helium hotspot experience. 

The hotspot is a $350 device that plugs into an outlet and sits on your Wi-Fi network. When you open the box and plug the router in, you start by downloading the Helium app, which is available on iOS and Android. (I'm using Android). First up, you'll need to choose a set number of security words in case you need to access your account. 

Because this is a secure network, only you have these security words, and only these words will unlock your account so that you can get tokens and adjust things. If you lose them, you will be forever locked out of your Helium hotspot and the tokens it generates. So write them down on the card they provide with the box and store them safely. All of which also means that once you own a Helium hotspot and link it to your account, you are its owner forever. That might change one day, but for now, there's no resale value in a Helium hotspot. 

Once you have your words securely written down and stored, the process of getting the hotspot up and running takes about two minutes. Seriously, you just plug in some cables and let it go. It took mine about three days to finally authenticate to the network, but that's probably because I live in a remote area and am the only hotspot for miles. In nearby Seattle, however, there are quite a few.

So far, I've earned 520 Helium tokens since joining the network on March 2, and I can send those to others using the system by using a QR code. I'm not super clear on this part, since I've been in quarantine that whole time and don't really have a device that needs data at the moment. I'll also note that if you don't want to buy a Helium hotspot, Helium is fine with that. The company is licensing its software so makers can put it on their own LoRa hotspots while still becoming part of the overall network and earning tokens.

To test my network, Helium sent me a LoRa GPS tracker. While they added it for me, it seems like a simple enough process to connect a device to the console. One way or another, I can now manage my devices and eventually transfer data credits so those devices can stay connected. Currently, data credits aren't needed during the beta process.

I can now track where my LoRa GPS tracker goes on a map or create notifications, as well as send the data from the GPS tracker to other cloud services. Someone who has more experience with backend device management applications would need to review the features of the platform, but I thought it was fairly easy to understand. Coverage isn't a problem for me on the island where I live, and I've picked up other hotspots during my brief journeys into Seattle for doctor's appointments. 

I haven't embarked on my usual spring conference travels because of the quarantine, but Helium's coverage map, for now, seems to have most major U.S. cities covered. I am excited by the concept, and hopeful that the company can really bring an LPWAN to the mass market. And honestly, I'd be thrilled if my network were to be a part of that, tokens or not.

IoT products have the potential to transform every aspect of your business. In this guide, discover everything you need to know to make your product vision a reality. You’ll find:

• Best practices
• IoT development paradigms & frameworks
• Potential use cases

Download now

UL launched its IoT device certification program last year, with five levels ranging from bronze to diamond depending on the strength of various security practices. I recently downloaded the full specifications to understand what made a device gold vs. diamond, and whether or not a gold-certified device was really secure.

Gold-certified devices, for example, don't have a hardware root of trust. That means there's no secure element on the device side to ensure it can't be co-opted to run malicious code. Gold certification doesn't require user data to be anonymized (only diamond-certified devices do that) nor does it ensure that when error messages or logs files are sent those files won't expose sensitive information. And they don't require notification if the company decides to change the privacy policies associated with data and the device.

Still, gold-certified devices are probably secure enough for most home appliances. Companies have to make trade-offs between security and convenience, and also between cost and convenience. Implementing the highest levels of security on a common device doesn't always make sense if the data it has isn't sensitive, or if it's not a device that can be controlled remotely to create physical damage. 

However, in general, I'm frustrated that gold is the middle of the certification pack, leaving silver and bronze certifications as viable options. To achieve a bronze-level certification, a device basically has to avoid using a default password, allow a factory reset with the push of a button, and have an update policy. What it doesn't need to do is monitor the app or cloud for vulnerabilities. Nor does it need to anonymize or erase customer data on request, or to have a vulnerability management program. 

I'm not sure I'd trust a bronze-certified device to count my eggs, much less do anything close to a real job in my smart home. And yet, I worry that a consumer might pick up a product, see that it has a bronze-level UL security certification, and think they were getting some kind of commitment to security that the device won't deliver. 

Beau Woods, a cybersecurity expert and advocate with I Am The Cavalry, says that it's good to see companies like GE Appliance using the UL certification because it shows that they are thinking about security. But he does wish the lowest UL certification had more security elements to it.

"I think there are some good things in bronze, but I think there should be a lot more in bronze," he says. For example, he thinks having a vulnerability disclosure program is essential for any connected product, and to really do that well a company should have a software bill of materials so they know what's in their product that might be vulnerable.

But having a software bill of materials isn't mandated until a product tries for the two levels above gold. And even at the bronze level, it doesn't appear that a company has to have some way a security researcher could reach out to a vendor to let them know their software has a bug. Woods thinks that should be part of any security program.

I personally worry that someone might look at a gold certification and think it was the best option. Gold might be good for a washing machine or fridge, but it's not good enough for a consumer device that has sensitive data or a device connected to critical infrastructure systems or banking accounts. So I suppose my hope is that as UL rolls out these labels people will get more sophisticated about what certifications matter based on the device role and the data it has.

The IoT Podcast Hotline is brought to you by Schlage. With 100 years of experience in the security industry, turning innovative ideas into smart solutions is what we do best. See how staying at the forefront of IoT adds convenience and security to your life at Schlage.com.