By –Dr. Anirban Ghosh, Associate Professor, Department of Electronics and Communication Engineering, SRM University – AP (Amaravati)
Every festive season, Indian homes add a few more connected gadgets to the mix: a video doorbell for the apartment gate, a smart plug for the water heater, a fitness band, a baby monitor that streams to a phone, or something more sophisticated to ease life. Most of these devices now come with a quiet reassurance of “regular security updates.” It suggests a problem solved.As if a security update, once installed, makes a device permanently safe, the way a vaccine is expected to provide lasting immunity.
This belief, more than any actual insecurity in the devices themselves, is the real weak point and deserves a closer look. It is not justbecause IoT devices are insecure, but because “gets security updates” and “is safe” are not the same claim.So,treating them as interchangeable creates a much more precise kind of risk than most people realise.The gap between what is claimed and what it meansis three separate problems once you look closely, each one narrowing the promise a little further.
The first of these is the most fundamental and is built into what a security update can ever do. It addresses a specific flaw that someone, such as a researcher, a hacker, or sometimes an attacker, found. It,however, does nothing for the flaws that haven’t been discovered yet. A device that updates regularly is not “secure” in any settled sense; it is a device where known holes get patched as they surface, while the next one is still waiting to be found. This is a meaningfully different promise than the one implied by the reassuring checkbox on a product page, and hence “updated” can quietly mean “still exposed.”
The second reason is more structural, and it splits Indian smart-device buyers into two groups based on price point without them realising it. Manufacturers rarely commit to updating a product for their entire working life. A mid-range smart camera or video doorbell, sold with the promise of updates, usually gets that support for a defined windowof two to three years.The manufacturer typically moves on to newer models at intervals and stops issuing patches in the hope of phasing out the old models. The device, however, keeps running, often for eight to ten years, well past the point where anyone is providing security updates. So, the update, real while it lasted, has an expiry that the buyer is never told clearly at the point of sale.
The third piece is where things get sharper still.Budget sensors and low-cost smart devices increasingly common in Indian homes these days diverge entirely from the story above. To receive an update at all, a device should have the requisite hardware or framework built in. Itshould be capableof checking for new code, verifying it for tampering, and installing it safely, and that costs money.At the very bottom of the price ladder, it is often one of the first things left out to hit a target price. Thus, these devices were never built to ever be updated. Such devices stay in the security state they were shipped in for their entire lifecycle on your network.
Put together, this is not one story but three and conflating them is exactly the mistake worth correcting. Even a device that is actively updated only ever closes the gaps that have already been found.The protection it offers, at its very best, is partial and reactive. To add to the fundamental concern is the extent of a support window that runs out long before the life cycle of a mid-range device itself does.Furthermore, at the lower end of the spectrum, the cheapest ones have no way to ever receive a fix at all once manufactured. Thus,“gets security updates” turns out to describe three quite different, increasingly weaker positions.
None of these is a case for abandoning connected devices,because they are useful, and that is not in question. It is a case wherethe guarantee of safety is, at best, a partial defense against known flaws. Even so, it is temporary for some devices, and absent entirely for others. Thus, the question worth asking before a purchase is notwhether the device“gets security updates,” but “for what and how long, and what happens after.” Right now, almost nothing on the box answers that!
