What mechanical locks can teach us about digital IoT security

If you have ever attended Secure360 Twin Cities, you likely have heard of and attended Deviant Ollam’s hands-on lock picking demo at the end of his presentation. His demo always features the latest in locks, pick tools and other penetration tester’s gadgets. Attendees are able to tinker with locks and tools and learn hands-on how the fundamental hardware of mechanical security operates and how it can be compromised.

Although this demonstration is focused on mechanical security, it is always a jam-packed event at our primarily digitally-focused conference.

When mechanical and digital locks converge

Mechanical security and locks have been dated back over six thousand years to the time of the Pharaohs, but recently, they are converging with digital IoT security systems in the form of passwords or fingerprints on your smartphone and “smart locks” on your doors. As these mechanical locks are being used in unison with digital security measures, there may be lessons that cybersecurity developers can learn from mechanical lock experts and vice versa.

We’re still relying on weak measures

As you know from Ollam’s demonstration, you may have realized the many locks we rely on are often extremely easy to break into or bypass. And yet, how many of us are still using these locks to secure our expensive bike on a busy city street or store or wallets in the gym locker? We know that our locks may be easily picked, but we take them for granted, assuming they will still prevent a thief from stealing our belongings.

We’re shifting towards convenience over quality

Convenience is becoming a huge value, for everyday products and security measures. IoT has helped make everyone’s lives easier, but not always as secure. When considering which security measures to purchase in the market, individuals and businesses are more focused on the convenience. As more security systems, both physical and digital, are added to the market, we must continue to think about the quality of the service and materials and not focus as much on the convenience.

Security must continually evolve

It wasn’t until recently that the average person realized how easy it was to pick a mechanical lock. Maybe we can blame the internet for making this common knowledge—first was the MIT Guide to Lockpicking, then a 2003 paper on breaking master key systems. After this, lock-picking information became readily available online, many of these techniques already known in both the criminal and locksmith communities. As a result, lock companies responded with more complicated locks.

In the same way that locksmiths have had to evolve their locks to continue to keep out thieves, cybersecurity measures and tools must continue to evolve to keep out criminals who have already figured out how to break into previous systems.

Interested in learning more about both mechanical and digital security? Attend Secure360 Twin Cities in May 2017 for two full days of security topics, sessions, networking and more!