Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
3/7/2017
09:25 AM
50%
50%

Consumer Reports to Grade Products on Cybersecurity

The ratings group will begin to consider products' cybersecurity following a rise in attacks on IoT devices.

The non-profit consumer ratings group Consumer Reports plans to evaluate cybersecurity and privacy when ranking products, Reuters says. It is currently working with organizations to create methodologies for doing this. An early draft of standards is available here.

This decision was made following a recent increase in cyberattacks on IoT devices, many of which contain vulnerabilities easily exploited by hackers. Researchers believe these attacks are unlikely to cease because manufacturers do not want to spend on securing connected products.

The draft prepared by Consumer Reports includes an analysis of built-in software security, amount of customer details collected, and whether all user data is deleted on account termination.

Jeff Joseph of the Consumer Technology Association describes this decision as positive but believes Consumer Reports "must be very clear about how they score products and the limitations of what consumers can expect."

The new grading methodology will gradually be introduced, says Consumer Reports.

Read Reuters for details.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
ScottDeaver1954
50%
50%
ScottDeaver1954,
User Rank: Apprentice
3/18/2017 | 9:56:36 AM
Consumer Reports has completely screwed up this up aready
Consumer Report's approach to this massively complex problem has been a kluster-kludge from the get-go. Their first assumption (that all software systems written for Iot devices will be new) speaks to just how naive and ill-informed they really are.

An in-depth discussion (very well worth the read fro anyone interested in cyber-security) of the issues with Consumer Reports entry into ratings is availablwe for free at the Ceritude Digital webste. From their main page on that site, go to the footer links at the bottom of the page and select the link labeled "Blog (from our CTO)". Library". Near the top of the blog is an article entitled "Should Consumer Reports Set Cybersecurity Standards?"

Alternatively, you can go to F. Scott Deaver's LinkedIn page and look for the "Should Consumer Reports Set Cybersecurity Standards?" topic among his other articles.

 
jagriti_123
100%
0%
jagriti_123,
User Rank: Apprentice
3/9/2017 | 7:39:17 AM
Want to be cyber secured?
Join the cyware team. Read about cyber security news and stay cyber aware.
CCrowMontance
50%
50%
CCrowMontance,
User Rank: Author
3/8/2017 | 3:00:23 PM
This is the start of a trend of cyber-rating
Products, companies, and software will soon have a slew of "ratings" associated with them. Like the motion picture association of America's familiar ratings (G, PG, R), these will help consumers to understand what they're signing themselves up for. Unlike the MPAA ratings, there isn't going to be a single authority for ratings and there is going to be substantial vendor influence on what the ratings actually measure.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Average Cost of a Data Breach: $3.86 Million
Jai Vijayan, Contributing Writer,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-18112
PUBLISHED: 2020-08-05
Affected versions of Atlassian Fisheye allow remote attackers to view the HTTP password of a repository via an Information Disclosure vulnerability in the logging feature. The affected versions are before version 4.8.3.
CVE-2020-15109
PUBLISHED: 2020-08-04
In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipm...
CVE-2020-16847
PUBLISHED: 2020-08-04
Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request, aka CFD-4887.
CVE-2020-15135
PUBLISHED: 2020-08-04
save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF...
CVE-2020-13522
PUBLISHED: 2020-08-04
An exploitable arbitrary file delete vulnerability exists in SoftPerfect RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can allow an unprivileged user to delete any file on the filesystem. An attacker can send a malicious IRP to trigger this vulnerability.