Audit of the Administration of the Internet of Things

This is a 2018 State Auditor performance audit about how Massachusetts agencies were using and managing Internet-connected devices during the audit period.

“This report details the audit objectives, scope, methodology, findings, and recommendations for the audit period, July 1, 2016 through March 31, 2017.”

Auditors wanted to see whether the state technology office was properly supporting agencies that were starting to use Internet of Things devices.

“We assessed the services that the Executive Office of Technology Services and Security (EOTSS) provided to agencies that were adopting the IoT.”

Connected devices can help government work better, but each one can also create a new opening for cyberattacks if it is not managed well.

“Every device that is connected to an organization’s network increases the opportunities for it to be attacked by a hacker.”

For residents, this technology can affect everyday services like train arrival information, energy use in public buildings, air-quality monitoring, benefits access, and tolling.

“The MBTA uses global positioning system devices on trains to provide their locations and estimate their times of arrival at stations, which improves communication with riders.”

The audit’s bottom line was that Massachusetts had made some progress, but still needed better IT security policies, an incident response plan, and stronger review of projects that connect devices to the state network.

“Although the Commonwealth has taken, and continues to take, measures to improve its information technology (IT) operations and security, we identified areas where IT administration could be improved to ensure the effective and efficient adoption of Internet of Things (IoT) technology.”

The auditor recommended that EOTSS create IoT security guidance, finish a formal incident response plan, and require agencies to check with the state chief information officer for projects involving the state network.

“EOTSS should develop a documented information security incident response plan.”

The stakes are practical: without clear response plans and controls, the state may be less prepared to limit damage from cyberattacks involving connected devices.

“Without an incident response plan, the Commonwealth has inadequate assurance that it can effectively respond to and minimize the risk of cyberattacks when they happen.”

Internet of Things means ordinary equipment, sensors, phones, meters, vehicles, or other devices that connect over a network and send or receive data without a person manually moving that data each time.

“The Internet of Things (IoT) is the interconnection of devices via the Internet to allow the devices to collect and receive data over a network without requiring human-to-human or human-to-computer interaction.”