Ambient computing is coming; security teams may not be ready

For decades, people have been captivated by the idea of the home of the future. Think back to The Jetsons: The futuristic cartoon family had a house that featured technologies like a robot vacuum, automated food preparation, and robotic arms to help with dressing and grooming.

While we don’t yet have robots that dress us, some of the Jetsons prophecies have already come true (I’m looking at you, iRobot). The majority of us have already welcomed smart devices into our homes in some capacity and will continue to do so.

Ambient computing

A recent article in The Wall Street Journal paints a fascinating picture of what ambient computing could look like in our homes in the near future, and it’s not unlike The Jetsons. Imagine a connected network of devices in your home that does things like take inventory of your fridge and order items you’re running low on; provide suggestions (including a visual mockup) of what to wear; project your calendar on your bathroom mirror as you brush your teeth each morning; and much more.

And that’s not all. Ambient computing will undoubtedly make its way into the workplace as well. Driverless cars could take us to work and intelligently navigate traffic without bothering us. Once we’re at work, smart office systems could adjust HVAC operations to efficiently cool or heat specific areas according to employee movements, schedules and patterns.

Furthermore, the buildings themselves could communicate with utilities to optimize power generation and storage operations. In an increasingly connected world, every new connection creates potential new use cases.

Whether or not this sounds appealing to you personally, experts believe the ambient computing revolution is just five to 10 years away. And in many ways, it’s already here — just on a smaller scale.

Chances are you own at least one smart device, whether a virtual assistant or a smart thermostat. By next year, over half (53.9%) of U.S. households will actively use smart home devices, and the global smart home market is projected to reach a staggering $537 billion by 2030.

Security risks of smart technology

As we let more technology into our homes, it’s important to consider the security risks, as they’ll only become more pronounced as ambient computing becomes a reality.

Currently, most smart devices in our homes are not connected to each other. But as the number of devices we own increases — and those devices become interconnected — a door opens for a slew of potential security threats.

Every one of these devices will be connected through APIs (application programming interfaces), and more APIs equals both more reward and more risk. APIs are the “connective tissue,” so to speak, between everything digital today.

For example, if you adjust the lighting in your living room via an app on your phone, that communication happens through an API. Additionally, these devices will be collecting sensitive data about everything we do, from our sleep patterns to the times of day we leave and return from work.

Giving interconnected smart devices access to this data will no doubt make life easier in many ways, but we need to think carefully about the possible negative implications. Will there be downsides to in-home tech having a clear picture of how we go about our daily lives? Things like your coffee machine turning on as soon as you wake up are great, but what happens when, say, your health insurance rates are adjusted based on how many pints of ice cream your smart freezer orders each month?

Even in a world where there are policies in place to protect from these kinds of things, the information is still out there. There will always be some level of risk, whether it’s hackers accessing health data to steal someone’s identity, or sensitive data being used unethically for marketing purposes. Regardless of the degree to which ambient computing develops, the time to focus on strengthening API security is now.

There are currently two things happening that make securing APIs difficult. First, the number of APIs being created, maintained, and used in these environments is growing exponentially. Second, the traffic and volume of information these APIs are transacting is through the roof.

Add to the equation microservices and connections between devices, and the potential for vulnerabilities is quite high. For an attacker who knows what they’re doing, exploiting these APIs can be relatively easy once they find a vulnerability.

Protecting an expanding API attack surface

Essentially, risk is higher than ever before. But it’s impossible to scale a security team exponentially to keep up. There needs to be more intelligent analysis of the information that’s being transacted in order to respond to the speed and growth of information at scale. Automation is critical for closing the gap between what a security team can handle on its own, and the ever-expanding API attack surface that exists today and will skyrocket with the rise of ambient computing.

Whether you’re excitedly awaiting the smart home of the future, or still getting comfortable with having a virtual assistant, API security is a critical issue that has the potential to impact us all. As ambient computing evolves, automation will continue to play a vital role in keeping APIs everywhere secure.

Shay Levi is cofounder and CTO of Noname Security.