The Impact of IoT on Cyber Security: Challenges and Solutions

Every time a customer tracks a delivery in real time, a warehouse robot scans a shelf, or a smart POS terminal processes a payment, a device somewhere is quietly talking to the internet. This is the Internet of Things (IoT) at work, and it has become the invisible backbone of modern retail and e-commerce. But every connected sensor, camera, or scanner is also a potential entry point for attackers, and that trade-off between convenience and risk is exactly what makes IoT one of the most pressing challenges in cyber security today.

What IoT means for e-commerce businesses 🔗

IoT refers to a network of physical devices, embedded with sensors and software, that collect and exchange data over the internet without needing constant human input. In an e-commerce context, this includes RFID inventory tags, smart warehouse robotics, connected delivery vehicles, digital payment kiosks, and even smart shelves that track stock levels in real time.

These devices generate an enormous volume of data every second, from customer footfall patterns to cold-chain temperature logs for perishable goods. That data is valuable, but it also multiplies the number of doors a hacker can try to open. Traditional IT security was built around securing computers and servers. IoT security has to cover thousands of small, often low-power devices scattered across warehouses, delivery fleets, and retail stores.

Why IoT devices are a growing cyber security risk 🔗

IoT devices were largely designed for function and cost efficiency, not for security. This gap between usability and protection is the root of most IoT-related breaches.

Weak authentication and default settings 🔗

A large share of IoT devices ship with default usernames and passwords that are rarely changed after installation. Many also skip basic security updates entirely. Research published in the International Journal of Experimental Research and Review points out that insufficient authentication remains one of the most significant obstacles in IoT security, since devices frequently transmit data without adequate encryption and rarely receive timely patches. For an e-commerce business, this could mean an unsecured smart camera at a warehouse entrance becomes the weak link an attacker uses to reach the entire network.

A massive and fragmented attack surface 🔗

Unlike a single web server, an IoT deployment might include hundreds of sensors, scanners, and controllers, each running different firmware and communication protocols. This fragmentation makes consistent security monitoring difficult, and a single unpatched device can act as a backdoor into otherwise well-protected systems.

Interoperability and compatibility issues 🔗

Retail businesses often mix devices from multiple vendors, each with its own security standards and update cycles. When these systems are forced to talk to one another without a common security framework, gaps appear at the connection points. This lack of standardisation is one of the reasons the Ministry of Electronics and Information Technology pushed for structured IoT policy frameworks in India, aimed at building common technical and security standards across the industry.

Encryption: the first line of defence, and its limits 🔗

Encryption converts data into unreadable code that only authorised parties can decode, and it is central to protecting information as it moves between an IoT device, a company server, and the cloud. According to Fortinet’s cyber security resources, encrypting IoT data communications gives organisations confidentiality of content, authentication of origin, and assurance that data has not been altered in transit.

The catch is that most IoT devices are built with limited processing power and small batteries, which makes it harder to run strong encryption without slowing the device down or draining its power quickly. Manufacturers often respond by using lighter, weaker encryption, or skipping it altogether on lower-cost devices. Even where encryption is implemented, cryptographic keys need careful management. A poorly stored key can undo the protection encryption is supposed to provide.

For an online retailer, this matters directly. Payment terminals, customer-facing kiosks, and delivery tracking apps all handle sensitive data, and any weak link in that chain can expose customer information or transaction details to interception.

Physical tampering and information attacks 🔗

Cyber security discussions often focus on remote hacking, but IoT devices face a very physical risk too. A poorly secured smart camera, payment kiosk, or delivery locker sitting in a public or semi-public space can be physically opened, probed, or swapped out. The OWASP IoT Top 10 list identifies lack of physical hardening as a core vulnerability category, noting that unauthorised physical access can allow attackers to extract data, modify firmware, or use the device as an entry point into the wider network.

Common mitigation steps include disabling exposed debug ports, using tamper-evident casings, and ensuring devices do not store sensitive credentials in easily removable memory. For e-commerce operations that place smart devices in warehouses, delivery vans, or retail floors, physical security has to be treated as seriously as network security.

How India is responding: regulation and certification 🔗

India’s regulatory approach to IoT security has developed steadily over the past decade, moving from broad IT law to device-specific standards. The Department of Telecommunications and MeitY now jointly oversee this space, with the Telecommunication Engineering Centre’s Code of Practice for Securing Consumer IoT setting baseline expectations such as eliminating universal default passwords and mandating secure software updates.

On the certification side, the STQC Directorate’s IoT System Certification Scheme lays out detailed baseline requirements that devices must meet, covering risk assessment documentation, vulnerability disclosure processes, and product lifecycle security. Businesses sourcing IoT hardware for warehouses or retail outlets can use this certification as a practical checklist when evaluating vendors.

Building a practical IoT security strategy 🔗

For businesses running e-commerce operations with connected devices, a few practical steps go a long way in reducing risk.

Security by design: Choose vendors that build security into devices from the start rather than adding it as an afterthought, and prefer devices that carry recognised certifications.

Network segmentation: Keep IoT devices on a separate network from core business systems, so that a compromised sensor cannot directly reach payment or customer databases.

Strong, unique credentials: Replace default passwords immediately and enforce regular password rotation across all connected devices.

Encrypted communication: Ensure data moving between devices, servers, and the cloud is encrypted end-to-end, with proper key management practices in place.

Physical hardening: Secure devices placed in public or semi-public areas with tamper-evident enclosures and disabled debug interfaces.

Timely updates: Establish a process for applying firmware and software patches promptly, since outdated devices remain the most common entry point for attackers.

Vendor due diligence: Evaluate how long a manufacturer commits to supporting a device with security updates before making a purchase decision.

None of these steps are one-time fixes. IoT security has to be treated as an ongoing process, because the devices themselves, the threats targeting them, and the regulatory expectations around them keep evolving together.

What do you think? As more retail operations lean on connected devices for everything from inventory to last-mile delivery, where should the responsibility for securing that data sit: with the device manufacturer, the business deploying it, or the regulator? And would you feel confident sharing your payment details at a smart kiosk if you knew how it handled encryption?

References

1. https://qtanalytics.in/journals/index.php/IJERR/article/view/4988
2. https://www.meity.gov.in/static/uploads/2024/03/Chapter-3_0.pdf
3. https://www.fortinet.com/resources/cyberglossary/iot-security
4. https://www.vumetric.com/blog/what-is-the-owasp-iot-top-10/
5. https://the420.in/india-iot-security-guidelines-dot-meity-tec-31318-mtcte-stqc-cert-in/
6. https://stqc.gov.in/sites/default/files/2024-12/IoT_F03_TCF%20Issue%204.0.pdf