Digital Brain
digital brain
digital brain

Avoiding the Perils of a Connected World: New Best Practices for Risk Mitigation

August 31, 2022 Business Law Bulletin 3 minute read

On August 25, 2022, the Canadian Center for Cyber Security (“CCCS”) released updated guidance on risk mitigation when using internet of things (“IoT”) devices, which provides new and important considerations for business activity.[1]

What is Internet of Things?

IoT refers to the network of everyday web-enabled objects that can connect and exchange information, and are often referred to as “smart” objects. Items that use the IoT network include not only laptops and smartphones, but also items like personal fitness trackers, TVs, thermostats, connected cars and home surveillance devices. IoT devices use the Internet to send data to the cloud for processing, where it is then shared with other network-connected devices through the use of Bluetooth, Wi-Fi or RFID technology.

Why is this guidance important?

The use of proper security and privacy protection is increasingly important in the context of these devices, with CCCS projecting that by 2025, there will be more than 30 billion IoT connections with an average of four IoT devices per person.

With capabilities to improve workflow and productivity, IoT devices are often used to make routine tasks more efficient and convenient. For example, using a mobile phone payment device attached to a smartphone makes for for a simple, convenient payment method. From an organizational perspective, uses for IoT devices include teleconferencing equipment, voice activated devices, networked security cameras, and corporate mobile phones, among many others.

What are the privacy and security implications of IoT technology?

IoT technology can create incredible upside for companies that wish to leverage the technology to facilitate a more creative, efficient and innovative environment for employees to succeed in their roles, but can also pose a high level of security risk for the business. Organizations that allow employees to bring their own smart devices to work can pose even more risk to security.

Without proper oversight and consideration, IoT devices can leave a business’ network and data vulnerable to numerous potential threats. Threat actors can take advantage of these vulnerabilities, causing a compromise of internal systems, including unauthorized security access to items like mobile Internet-enabled microphones without consent to listen in on conversations, or maliciously disrupting Internet access.

In a broader context, the security of IoT devices also applies to critical infrastructure used in industrial operations (i.e. mining, energy, transportation or medical) which can pose a broader risk to the public and business community at large.

How can businesses protect against IoT threats?

Organizations must carefully consider the implications of deploying these devices in connection with their businesses. To keep IoT devices secure, the CCCS recommends implementing or updating an organization’s plans and policies that identify the security capabilities and possible vulnerabilities of an organization’s network. In particular, the updated guidance recommends:

  • the use of two-factor authorization for devices and applications to add additional layers of security;
  • disabling automatic connection services;
  • the use of passphrases rather than passwords on all workplace IoT devices; and
  • ensuring that data generated by IoT items is encrypted.

Additionally, the CCCS recommends that organizations remember that IoT devices can help find efficiencies in workflows and processes, but an organization inherits the security issues of any connected device on the network. If used in the workplace, the organization should implement policies to ensure IoT devices are introduced, used, and managed securely. Finally, there should also be policies enforcing appropriate data storage on all devices.

If you have any questions about these guidelines, maintaining compliant privacy and cybersecurity policies, or about privacy and cybersecurity more generally, a member of our Privacy & Data Protection Group would be happy to assist you.

[1] Canadian Centre for Cyber Security, Internet of Things: CCCS Best Practices for Risk Mitigation (August 25, 2022), available here.

by Robert Piasentin, Kristen Shaw and Hailey Lonsdale (Articled Student)

A Cautionary Note

The foregoing provides only an overview and does not constitute legal advice. Readers are cautioned against making any decisions based on this material alone. Rather, specific legal advice should be obtained.

© McMillan LLP 2022

Insights (5 Posts)

Featured Insight

The State of Play in Shareholder Activism: Issues, Concerns and Trends

Join us for a series of engaging discussions on shareholder activism in Canada. Industry experts will share valuable insights into regulatory and market issues, concerns and trends.

Featured Insight

CSA Publishes Results of Continuous Disclosure Review Program Activities

CSA Staff Notice 51-364 - Continuous Disclosure Review Program Activities for fiscal years ended March 31, 2022 and March 31, 2021.

Read More
Jan 26, 2023
Featured Insight

Canadian Securities Administrators Comment on Disclosure Related to Mineral Projects and Technical Reports

On November 3, 2022, the Canadian Securities Administrators published Staff Notice 51-364 Continuous Disclosure Review Program Activities for 2022 and 2021.

Read More
Jan 24, 2023
Featured Insight

Let Them Roll: Dispute Settlement Panel Rules in Favour of Canada and Mexico on Automotive Rules of Origin and “Roll-Up” Method under CUSMA

Analysis of recent CUSMA panel decision on automotive rules of origin. Use of the roll-up method for core parts was in dispute between Canada, US and Mexico.

Read More
Jan 24, 2023
Featured Insight

Quebec Superior Court Orders That Corporations Must Provide Information to Police – Even Where Data Stored Abroad

The Quebec Superior Court rules the American companies may have to produce documents stored abroad to aid in Canadian criminal investigations.

Read More
Jan 24, 2023