By now you’re probably aware that the push to connect everything to the Internet has been at the cost of security. Many IoT (Internet of Things) devices are poorly secured and can expose users to significant threats. I always encourage people to consider whether they really need their toaster to be connected to the Internet, and disable that feature if the answer is no.

Until recently, the IoT landscape was like the wild west, with little or no regulation of the security aspects of these devices.

But there’s reason for optimism, as reported by Bruce Schneier. Consumer Reports, the venerable consumer protection organization, is now testing the security of IoT devices, starting with home security cameras. Hopefully CR’s focus on security will be extended to other types of IoT devices soon.

Goverments are also waking up to the threat. California’s new SB 327 law, which will come into effect in 2020, will require that all network-connected devices meet basic security requirements. Other governing bodies are sure to follow, hopefully soon. Ultimately, we should have security standards for connected devices everywhere.

These efforts seem likely to get the attention of IoT device manufacturers, and encourage them to improve the security of their products. In particular, IoT devices need better security out of the box, with risky features disabled by default instead of enabled. Many devices are still shipped with well-known default passwords, and remote administration access enabled by default.