The first precaution to take is to ensure a high level of password complexity. A password must contain a mixture of upper- and lowercase letters, numbers and special characters. You can test the strength of your password through free tools such as https://howsecureismypassword.net/. Default accounts of connected objects are generally known and appear in public documentation. It is, therefore, very easy for an attacker to test these front doors in an attempt to take control of an IoT. When first accessing the configuration settings of the IoT device, it is advisable to create your personal administrator account and then delete the default accounts. This way, attacks on these easy targets can be prevented. When buying a connected watch, it is imperative to check that pairing with a smartphone and unlocking the screen can only be done with a pin code, password or touch gesture. Otherwise, data recovery after a theft would be very easy…

Smart watches are intended to be connected to our smartphone but can also exchange a large amount of sensitive data with

• different types of sensors (heart rate, power, etc.),
• the platform set up by the manufacturer (e.g. Fitbit Connect, Garmin Connect),
• other online services (Strava, Weight Watcher, Map My ride),
• social networks or other platforms in the cloud.

The multiplicity of these connections increases the risk of data leaks. It is, therefore, necessary to ensure:

• Limit the number of connections with online services
• Check the reliability of the online services to which the data is sent
• Limit the data exchanged during connections
• Disable the automatic synchronisation of your connected watch when it is not necessary
• Secure online services linked to the connected watch with strong passwords
• Reject any requests to associate the watch with an unknown terminal

To reduce risks, it is advisable to choose recognised products from reputable manufacturers. These manufacturers generally have the means to invest in the development of quality products. If in doubt, prefer a purchase in a store from specialised sellers who can have them tested and give you technical advice. Before buying a device, check:
• whether encrypted communication can be activated,
• whether long-term security updates are provided,
• what data is transmitted to the manufacturer,
• how the data collected is processed and used.

One of the major issues is a common suspect in cybersecurity: failing to install software updates ("patches"). It is particularly important to use the patches provided by the suppliers. This is especially important for connected objects which are -by definition- permanently exposed to potential attacks. When updates are available for the wearable, they should be installed immediately. If there is an automated update feature, it should be enabled. Please note: with each update, modifications may be made to the structure of authorisations. Check permissions after each update and readjust if necessary.

To avoid any data leakage or hijacking, you must ensure that you deactivate your connected equipment which is no longer in use.

As with any contract, careful reading is required. The general conditions of use of a connected toy can be long and complex, but they are not trivial because they legally bind their users. The terms and conditions of online services associated with the connected watch should also be reviewed, as your vital data may no longer belong to you…