IoT
11/16/2016
04:45 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Security Experts Call For Regulation On IoT Cybersecurity

During a House Committee hearing today, Bruce Schneier also asks for the establishment of a new government agency devoted to cybersecurity.

Security experts asked lawmakers for more action, today, during a Congressional hearing on IoT security. On their wishlist: consequences to manufacturers for delivering insecure products, a federally funded independent lab for pre-market cybersecurity testing, and an entirely new federal agency devoted to cybersecurity.

The hearing, "Understanding the Role of Connected Devices in Recent Attacks," was held by the US House Committee on Energy and Commerce, with expert witnesses Dale Drew, senior vice president and chief security officer of Level 3 Communications; Dr. Kevin Fu, CEO of Virta Labs and associated professor of electrical engineering and computer science at the University of Michigan; and Bruce Schneier, fellow of the Berkman Klein Center at Harvard University. 

"We are in this sorry and deteriorating state because there is almost no cost to a manufacturer for deploying products with poor cybersecurity to consumers," said Dr. Fu. He later added "also there's no benefit if they deploy something with good security." 

"The market can't fix this," said Schneier, because "the buyer and seller don't care ... So I argue that government needs to get involved. That this is a market failure. And what I need are some good regulations."

Rep. Greg Walden (R-OR), however, noted, that in prior cybersecurity-related hearings, experts routinely caution them that regulations can lead to organizations misallocating their security resources, and agile threat actors quickly changing attack methods. Walden asked "how do we create a national framework where the stakeholders are really driving this in real-time, and we don't do something stupid, like lock certain requirements into statute?"

Drew suggested beginning by establishing standards, and using them to apply pressure. Schneier suggested setting benchmarks, but not methods of achieving them. "Here is the result we want. Figure out how to do it," Schneier said.

Fu said, "Encoding mechanism would be unwise ... however principles I think you can encode." Fu also recommended incentivizing better cybersecurity hygiene, support for the National Science Foundation and NIST, and the establishment of an independent lab for pre-market cybersecurity testing (perhaps modeled off of safety programs like the National Highway Traffic Safety Administration).

Rep. Anna Eshoo (D-CA) introduced a cyber hygiene bill last October that calls for NIST to set standards, not Congress, because, she said "[Congress will] miss the mark, we'll miss it by a wide mile." Eshoo said the bill "has not gained a lot of traction" but that the statements made by the witnesses "puts some wheels on it."

She was less hopeful, however, about the success about another recommendation made by Schneier: the establishment of a new government agency. 

Schneier said: "We can't have different rules if the computer has wheels, or propellers, or makes phone calls, or is in your body. That's just not gonna work. These are all computers and we're gonna have to figure out rules that are central."

He later held up his mobile phone, saying "It was ok when [this] was fun and games. Already there's stuff on this device that monitors my medical condition, controls my thermostat, talks to my car. I've just crosesed four regulatory agencies ... This is gonna be something that we're gonna need to do something new about. Like many new technologies of the 20th century, new agencies were created -- trains, cars, airplanes, radio, nuclear power. My guess is this is going to be one of them." 

Eshoo however, felt that a Republican majority in Congress would make this difficult. "New agencies, new regulations, we're dead in the water," she said. "But we can't leave this issue to be dead in the water. Our country deserves much better."

Rep. Frank Pallone (D-NJ) asked if regulation like that suggested by the expert witnesses today might stifle innovation.

"Yes, it will," said Schneier. "And I don't like that, but in the world of dangerous things, we constrain innovation. ... I personally don't like killer robots. I think they're a mistake and we should regulate them."  

"This is what we do when innovation can cause catastrophic risk," he said. "And it's catastrophic risk we're talking about. It's crashing all the cars. It's shutting down all the power plants. The internet makes this possible because of the way it scales. And these are real risks."

Fu said he worries "bureacracies" will get in the way of security. "I worry about the inability to change. I worry about being stuck saying 'we've never done it that way before.' I worry about saying things like 'well that's unprecedented.' Well, the Internet of Things is unprecedented. So there are going to have to be some changes." He compared it to the long path to making handwashing a habit. "It took 165 years before handwashing was common. It's going to take some time for security, but the time is right to do to do something right. To do something wise." 

Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Lily652
50%
50%
Lily652,
User Rank: Moderator
12/11/2016 | 1:17:15 PM
prayer times

This is the type of information I've long been trying to find. Thank you for writing this information. 

anacrophobic
50%
50%
anacrophobic,
User Rank: Apprentice
12/2/2016 | 3:07:10 AM
Re: The Market CAN and WILL fix this
I think you're missing the depth of what they're saying.  It's not that companies and consumers aren't motivated toward security when they're aware that they need it, it's that companies and consumers aren't aware that they need it.  When someone's hacking your fridge, they're not doing it to negatively impact you, they're doing it to install a botnet, or piggyback off of it to other parts of your network.  These are invisible threats the consumer doesn't see and will never complain about.  Because they'll never complain about it, there's no reputation or market impact to the manufacturer for not doing security.  And because there's no positive market incentive for the manufacturer to properly secure their devices, many won't.  Some larger companies will, only because they've already made the investment in expertise to create other secure devices, but smaller companies won't because there's no positive market reinforcement and a huge negative market reinforcement in terms of cost to build proper security.

Cell phones are a good example, even though I don't generally consider them a part of the "Internet of Things".  Android phone manufacturers could create drivers for their old hardware for newer versions of Android, and Carriers could push OS updates (with those drivers) to older handsets to patch security holes and generally improve security.  But... why would they?  If they did, consumers might start keeping their older handsets longer, as they'd get the features of the new Android OS without having to upgrade.  Sure, they might be wowed by new bells and whistles on the phone, but the new OS is still a draw for some consumers.  So why would the free market encourage manufacturers and carriers to work together to make less money?

The only way this changes, honestly, is if high profile attacks with immediate and visible negative impacts for consumers start to occur.  That would create the consumer drive to implement better security, which would create the Brand Reputation impacts necessary to make security a good thing, rather than a bad thing, for the company's bottom line.  But until the consumer sees the negative impacts of an insecure Internet of Things, securing those devices will remain too expensive for the company.  If you can't quantify how your increased security will improve the company's bottom line, chances are you'll probably not get the management buy-in required to implement your mitigations.  After all, even larger companies have other things, even other security-related things, to spend that money on.
Bolgar
50%
50%
Bolgar,
User Rank: Apprentice
11/18/2016 | 6:21:33 AM
Re: Pending Review
Thank for your article !
Ehanson005
50%
50%
Ehanson005,
User Rank: Apprentice
11/17/2016 | 2:45:01 PM
Regulation is not the answer
Regulatiuon is not the answer.  The fact is most people dont realize that they are living in a world where they have a complex wired and wireless network inside their own home.  Long gone are the days were a person could be secure with a software firewall on their PC.  With the advent of wireless devices, tablets, phones, televisions etc... that all conntect to the internet through your home network a home firewall appliance is more necessary than ever.  This could be somthing built in to the existing cable or DSL modems and managed by the service provider.
RickStaples
50%
50%
RickStaples,
User Rank: Apprentice
11/17/2016 | 9:35:51 AM
The Market CAN and WILL fix this
--- "The market can't fix this," said Schneier, because "the buyer and seller don't care ... So I argue that government needs to get involved. That this is a market failure. And what I need are some good regulations." ---

I could not disagree more.  As a 30+ year IT professional I have seen security grow exponentially year over year.  Where was the regulation pushing it?  I don't know anyone who does not have some sort of firewall in their home.  A highly unregulated environment to say the least.  Security is on everyone's mind these days - both buyers and sellers.  I don't understand where Schneier gets the idea that the Free Market won't put substantial pressure to make things secure.  Reputation is everything in a highly competitive marketplace. And, consumer confidence (fear) is a significant driver.

Security is on everyone's mind these days - both buyers and sellers.  I don't understand where Schneier gets the idea that the Free Market won't put substantial pressure to make things secure.  Reputation is everything in a highly competitive marketplace. And, consumer confidence (fear) is a significant driver.

There is too much downside getting the Government involved and little or no upside that the Market can't manage.

IMHO

 

 
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...