Keywords

1 Introduction

Fitness wearables are a part of the bigger interconnected world of the Internet of Things (IoT) [1, 2]. A fitness wearable is defined as a wireless sensor that is embedded in a device and can be worn on the body by the user [3]. This device incorporates a variety of capabilities including gathering, processing, transmitting, and storing user data [4, 5]. Fitness wearables are manufactured and put into the market to encourage users to participate in self-care through excises and health monitoring efforts [6].

The popularity of these fitness wearables is influenced by the increasing interest in self-tracking notion, where users can track and monitor their daily fitness-related activities [7,8,9,10]. However, the growing popularity of fitness wearables and their use poses security concerns [11]. These security concerns around the fitness wearables are not surprising, given the fact that these devices gather real-time data that tends to be at a personal and detailed level [12]. Hence, the discussions around personal privacy increase these concerns as users lose control of the data privacy [13].

The remainder of this paper is organised as follows: Sect. 2 presents the methodology employed in this study. Section 3 presents the findings and the output of this study, which is the information security controls for the fitness wearable manufacturers to mitigate the vulnerabilities affecting the fitness wearables ecosystem. Section 4 presents the limitation of this study and make recommendations for future research based on the limitations discussed. The limitations opens an opportunity to further this study. Section 4 concludes the study and highlight the contribution made by this study.

2 Methodology

This section discusses the methodology followed by this study. This study executed the methodology in two stages to achieve the identified objective/s. In Stage 1, the researcher conducted a literature review to identify vulnerabilities that affect fitness wearables from a security and privacy perspective. Stage 2 employed a systematic analysis approach to identify security controls for the fitness wearable manufacturers to mitigate the vulnerabilities. Subsections 2.1 and Subsect. 2.2 provide a more detailed discussion on each of these stages.

2.1 Stage 1: Literature Review

This subsection discusses the literature review followed to identify the vulnerabilities affecting fitness wearables from a security and privacy perspective.

Firstly, the researcher adopted the Open Web Application Security Project (OWASP) Internet of Things (IoT) 2018 project as a baseline to identify the vulnerabilities that exist in the IoT domain. This project started in 2014 to assist developers, manufacturers, and users to make better security decisions when designing and using IoT systems [14]. The OWASP IoT project released the top 10 IoT vulnerabilities that the broader IoT academic community endorses. Hence, the adoption by this study.

The literature identified the “Lack of Erasing Personal Data” as an additional vulnerability that is significant to the IoT domain and yet not on the OWASP list [15]. Therefore, this study will be focusing on eleven (11) vulnerabilities. The conducting of the literature review was to find earlier and recent published work that presents these vulnerabilities from the fitness wearable context. This study conducted comparison analysis of three source to understand the approach followed to identify vulnerabilities and security controls to mitigate those vulnerabilities. The findings from this analysis indicates that each of the sources follows the risk assessment approach which is the well-known approach for identifying vulnerabilities and security controls in an organizational context.

Furthermore, through the literature, the researcher identifies the components that these vulnerabilities affect within the fitness wearable ecosystem. Figure 1 below depicts the fitness wearables ecosystem to demonstrate the fitness wearables and their related components for the full fitness tracking and monitoring functionality. This study notes that there are various mode of communication and additional functionalities found in different fitness wearable brands and such include Apple smart watch that offers the fitness functionality and inbuilt cellular access. However, this study is focusing on general fitness wearables that offer fitness functionality and not on a specific brand or additional functionality within the wearables. A letter as presented in Fig. 1 represents each component in the ecosystem.

Fig. 1.
figure 1

Fitness wearables ecosystem

Full size image

2.2 Stage-2: Analysis Approach

This subsection discusses the analysis approach followed in this study. The purpose of this analysis is to identify a set of security controls for the fitness wearable manufacturers to mitigate the vulnerabilities affecting the fitness wearable ecosystem. Therefore, the identification of these security controls is done by determining the relevance of the security controls in the context of this study. In addition to determining the relevance, the identification aims to select critical security controls that will provide a high impact when implemented. These security controls are for fitness wearable manufacturers to mitigate the list of these vulnerabilities identified through the OWASP IoT Project.

The execution of this analysis was in a two-phased approach. This study used the NIST SP800-53 revision 5 to identify the security controls for mitigating the list of vulnerabilities identified. Figure 2 below depicts a high-level process followed in each phase. Each phase presents the steps involved. The subsections below presents a more detailed discussion on each the phases.

Fig. 2.
figure 2

High-Level Two-phased APPROACH

Full size image

Phase 1 Analysis

Phase 1 aims to identify the relevant security control families from the NIST. The NIST SP800-53 Rev 5 has 20 security control families and each consists of a set of security controls relating to the security functionality of that family. The main goal of Phase 1 is to identify the security control families that are relevant in the context of this study. However, Subsection A and Subsection B presents the two levels of relevance in the context of this study.

  1. A.

    Security Control Family Classification Filtering

The first level of relevance focuses on whether the technical and operational aspect of the security control families are possible for implementation. The technical aspect focuses on the implementation of security measures before the fitness wearable and its related components are in the public market. While the operational aspect focuses on security measures to ensure that the fitness wearable and related components are secure when used in the market and their security posture can always be improved. As a result, the researcher adopted the classification of security control family from NIST SP800-53 revision 1. The reason for adopting this classification from the earliest revision 1 (Rev 1) of NIST is simply because the latest revision (Rev 5) of NIST does not provide such classification. Furthermore, the earliest revision (Rev 1) provides only seventeen (17) security control families; therefore, the researcher had to classify the remaining security control families that did not exist in Rev 1. The additional classification emerges from the overall functionality of the security control family.

The NIST provides three classifications for the security control families. These classifications are namely: Management, Operational, and Technical. The selection of the security control families that are relevant in the context of this study is on two classifications, which are technical and operational. As a result, this study excludes security control family classified as management from this analysis. The researcher started with twenty (20) security control families, and after filtering out all the security control families falling under the management classification, the researcher identified sixteen (16) security control families (Table 1).

Table 1. NIST SP800-53 security control families
Full size table
  1. B.

    Security Control Family Functionality

The functionality of a particular security control family in the context of this study determines the second level of relevance. These criteria determines the inclusion or exclusion of the security control families. The focus was on filtering out security control families that are not relevant in the context of this study addressing fitness wearables and their related components. The previous subsection identified relevant security control families based on the technical and operational classifications. However, some of these security control families were irrelevant in the context of this study.

The Awareness and Training security control family focuses on training users in an organisational context and as a result, this security control family is irrelevant in the context of this study.

Another example of a security control family that falls under a relevant classification but is irrelevant in the context of this study is the Physical and Environmental Protection security control family. This security control family focuses on ensuring the protection of an organisation in terms of actual physical security to protect the physical infrastructure. This is relevant in the context of an organisation but is irrelevant in the context of fitness wearables and their related components. Table 2 presents the excluded security control families. These exclusions were because these security control families are applicable in an organisational context but not in the context of this study. The exclusion of a security control family excludes the individual security controls within that family.

Table 2. Filtering security controls: based on study context
Full size table

At the end of Phase 1, the researcher had six security control families that are relevant in the context of this study addressing the fitness wearables and their related components. Table 3 presents these security control families.

Table 3. Relevant security control families for study context
Full size table

Phase 2 Analysis

In Phase 2, the researcher focused on identifying individual security controls within security control families for the fitness wearable manufacturers to mitigate the list of vulnerabilities.

For this phase, the researcher took the list of vulnerabilities affecting various components within the fitness wearables ecosystem as an input into this Phase 2 analysis. In addition to the list of vulnerabilities, the researcher also took the six (6) security control families that were an output in Phase 1 to be an input in Phase 2. The purpose of using these two outputs as an input in this Phase 2 is to identify relevant security controls for the fitness wearable manufactures to mitigate these vulnerabilities.

This phase executes a more detailed analysis by going through each security control family and identifying individual security controls that are relevant in the context of the vulnerabilities and the manufacturer can use to mitigate these vulnerabilities. Furthermore, the identification of the security controls for the mitigation of the vulnerabilities is in three levels. The first level identifies security controls that will mitigate the vulnerability; the second level identifies security controls that will strengthen the security control identified for the first level. Finally, the third level identifies security controls as reactive measure in case of an incident. This structure presents Security control, Related Control, and Control enhancements. According to NIST, the “Security Control” as the main security control and recommends related controls to strengthen the main security control. These related controls are controls from other security control families. Lastly, the control enhancements are within the main security controls, which NIST recommends to strengthen the main Security controls. However, for this study, the adoption of the presentation structure is different. The “related controls” are not necessarily those recommended by the NIST, but they fit the context of this study and the same applies to the “control enhancements”.

Table 4 presents the identification of individual security controls. The study presents one example of vulnerability with mitigation security controls and the affected components. The components A, B, C and E are those presented in Fig. 1. The summary later is the study presents the rest of the vulnerabilities with their identified security controls.

Table 4. Identification of security controls for insecure data transfer snd storage
Full size table

3 Findings and Presentation

This section presents the main contribution of this study, which is the result of the methodology discussed in the previous section.

3.1 Vulnerabilities Affecting Fitness Wearables

This section presents a brief discussion and presents the vulnerabilities that affect fitness wearables and related components. The purpose of this discussion to illustrate how each vulnerability as described by the OWASP IoT project affects the fitness wearable and related components. The literature supports and validate the applicability of these vulnerabilities in the context of the fitness wearables.

Table 5 below presents the list of vulnerabilities adopted from the OWASP IoT project and a mapping of each vulnerability to the components it affects. A letter as seen in Fig. 2 above represents each affected component. However, this study excludes the component labeled “D” from this analysis as its security requirements are not the responsibility of the fitness wearable manufacture.

Table 5. List of vulnerabilities affecting fitness wearables and related components
Full size table

3.2 Identification of Security Controls

There are several internationally known security control standards, frameworks, and guidelines that provide a huge list of security controls that can be used to mitigate security risks [56]. These security control standards, frameworks, and guidelines include the International Organization for Standardization and International Electrotechnical Commission (ISO/IEC), Control Objective for Information and Related Technology (COBIT), and National Institute of Standards and Technology (NIST), just to name a few. However, for this study, the researcher selected the NIST as a baseline to identify security controls that will be relevant in the context of this study, which addresses the fitness wearables and related components.

The purpose of selecting the NIST standard as a baseline is because, this standard is a combination of several internationally recognized standards and best practices which include the ISO/IEC 27002 [57]. The specific NIST standard referred to by this study is NIST Special Publication 800-53. This publication presents security and privacy controls that are published for Federal Information Systems and Organisation [58].

Although the researcher identified one standard to use for identification these security controls, this standard presents a long list of security controls to select from, and selecting the best set of security controls is a challenge [59]. The identification of the most effective security controls has always been problematic and many approaches and techniques have developed over time to do this in the most effective manner possible [59,[60]. Barnard and Von Solms [59], acknowledges the existence of baseline manuals, however, they argue that these baseline manuals provide a little guidance on how to determine the best set of security controls to provide adequate security. Therefore, with this little guidance provided in the baseline manuals, there is a high potential of selecting irrelevant security controls and excluding the relevant ones [59, 61].

The literature recognizes the use of various mechanisms to identify a set of security controls to provide adequate security against security risks. However, such mechanisms are relevant in the context of implementing adequate security in an organisation. Hence, such mechanisms are irrelevant in the context of this study, which addresses the fitness wearables.

Table 6 below presents a summary of all the identified security controls for fitness wearable manufactures to mitigate each vulnerability.

Table 6. Summary of the identified security controls
Full size table

4 Limitation and Future Research

This study identified a set of security controls to mitigate the list of vulnerabilities adopted from the OWASP IoT project. Through the NIST SP800-53, the researcher identifies the security controls that were relevant in the context of this study. However, the limitation of this study is the evaluation process of these security controls. Through the literature, it was evident that selecting the best set of security controls can be a great challenge and there is a potential to include unnecessary security controls while excluding the important ones. This is due to the lack of guidelines for selecting the best security controls. Therefore, for future research purposes, this study foresees a need to conduct further research that will propose and develop an evaluation process or model or framework to evaluate these sets of security controls for completeness, accuracy, and to verify if they will be implementable in the context of fitness wearables.

5 Conclusion

The fast growing market of fitness wearables has changed the way people are viewing their health habits. These devices motivate people to track and monitor their health habits daily. However, the fast growing of these fitness wearables has shown security and privacy to be an issue to this day. This study identified vulnerabilities and security controls for the mitigation of these vulnerabilities. The identification of security controls will enable the fitness wearable manufacturers to mitigate the most common vulnerabilities that affect the fitness wearables and entire IoT domain. Furthermore, these security controls identified simplifies the selection and implementation. Each security control mitigates a particular vulnerability, and the fitness wearable component affected.