SA Forum is an invited essay from experts on topical issues in science and technology.

“We live in a connected world” is a well-worn axiom. Even so, few people realize the true extent of that interconnectivity. Networking giant Cisco Systems estimates that by 2015 as many as 15 billion devices will be connected to the Internet—more than double the world’s population. One forecast suggests that the number of such devices will reach 50 billion by 2050, and that is almost certainly an underestimate. Many of those machines will interact with each other without our intervention, and often without our knowledge. When that happens, the Internet of Everything will have truly arrived.I

But the Internet of Everything faces significant security challenges. It will consist of billions of devices programmed to handle multiple functions autonomously and asynchronously. Any node could be an attack vector for the entire system. Locating and containing a breach in such a dynamic, distributed system may be close to impossible. This matters because an attack on the Internet of Everything won’t simply destroy data—it will disrupt the physical world.I

The Internet of Everything has been described as a transition from “Machina habilis” to “Machina sapiens”—from a world where machines respond only to human commands to one in which machines, enabled with complex algorithms and adaptive behaviors, act as intelligent agents on behalf of individuals. By carrying out tasks ranging from optimized traffic management to monitoring the health of the elderly to nuanced control of energy usage, the Internet of Everything should make the world smarter and our lives easier. It will also make it much easier for hackers to cause real-world damage.I

We’ve already seen this sort of attack happen. The first came in 2010, when the Stuxnet virus targeted the systems that controlled centrifuges used in Iran’s nuclear program, causing them to spin destructively out of control. Stuxnet, which was probably a joint U.S.–Israeli venture, quickly created blowback. In August 2012 an attack on Saudi Aramco, which supplies about one tenth of the world’s oil, destroyed or compromised some 30,000 computers and 2,000 servers. The attack, which almost certainly originated in Iran, was intended to stop Aramco’s oil production. Although the hackers failed, former CIA director Leon Panetta described the attack as “probably the most destructive attack that the private sector has seen to date.”I

The Internet of Everything exponentially increases the potential for physically destructive cyber attacks. A 2010 paper on the security and privacy of wireless tire-pressure monitoring systems showed that hackers could easily intercept and decode a system’s sensor messages, triggering false alarms or spoof warnings that could potentially harm the driver. More recent research funded by the Defense Advanced Research Projects Agency (DARPA) has demonstrated the ease with which almost all the computerized systems in today’s cars—including the steering, accelerator and brakes—can be hijacked. Another researcher discovered that a system used to operate an electronic medicine cabinet for hospital prescriptions could easily be hacked, thanks to a software flaw. The potential for remote hacking of smart objects via new and novel vectors also exists. For example, Sandia National Laboratories is developing “radar responsive” tags, about the size of the stick-on RFID tags used in retailing. The tag about the size of the stick-on RFID tags used in retailing. The tags remain dormant until awakened by a radar pulse from as far as 19 kilometers away—and then indicate their location. The potential for abuse is not hard to envision.I

Security researchers are also worried about the rapid shift toward digital manufacturing. In May 2013 the Obama administration committed $200 million to an initiative aimed at accelerating the development of advanced manufacturing—meaning more machines, devices, sensors and smart nodes of every kind connected both to one another and to the Internet. Every one of those systems will be as vulnerable as their weakest link. It is not hard to imagine that a virus, inserted via a weak link, might reprogram a production line to produce components that are designed to fail, with potentially catastrophic consequences in industries as diverse as aerospace, health care, automobiles and construction.I

To date there has been little focus on how to secure the Internet of Everything, even as it is being deployed at a swiftly accelerating rate. Many of the devices, sensors and other nodes already in the field are about as secure as a wet paper bag. For the Internet of Everything to be acceptably hack-resistant, manufacturers must adopt a set of principles that include “security by design”—systems where the software has been designed to be secure from the ground up. They must ensure that any device attached to the Internet of Everything is capable of adapting in real time to emerging threats. There is also an urgent need to develop truly global security and trust frameworks for intelligent objects—the Internet of Everything knows no borders.I

And just as the verification of personal identity is crucial for many of the things we do on the Web (such as banking and shopping), the intelligent objects that make up the Internet of Everything must also have a foolproof means of digitally exchanging authenticated claims about their identity.I

In manufacturing the only real way to secure the supply chain is to monitor it from end to end—a Sisyphean task in a world where components are sourced diversely and globally. The first major attack on a developed world manufacturing facility will probably lead many companies to rethink their outsourcing strategies. The growth of 3-D printing may help those firms bring component manufacturing back “in house,” thus decreasing supply-chain vulnerability.I

Companies will also need to focus far more on containment. Although most corporations have built security perimeters, any adversary who breaches that perimeter can roam free. As machines and devices become more interconnected, companies must ensure that any attacker who penetrates part of a network cannot roam. That means authenticating machines and people, and isolating systems so that a soft target does not permit access to high-value assets.I

None of these security measures will stop a determined attacker. But given the vast potential of the Internet of Everything to transform our lives for the better, baking in security from the outset is the only realistic way forward.