Security Experts Call For Regulation On IoT Cybersecurity
During a House Committee hearing today, Bruce Schneier also asks for the establishment of a new government agency devoted to cybersecurity.
Security experts asked lawmakers for more action, today, during a Congressional hearing on IoT security. On their wishlist: consequences to manufacturers for delivering insecure products, a federally funded independent lab for pre-market cybersecurity testing, and an entirely new federal agency devoted to cybersecurity.
The hearing, "Understanding the Role of Connected Devices in Recent Attacks," was held by the US House Committee on Energy and Commerce, with expert witnesses Dale Drew, senior vice president and chief security officer of Level 3 Communications; Dr. Kevin Fu, CEO of Virta Labs and associated professor of electrical engineering and computer science at the University of Michigan; and Bruce Schneier, fellow of the Berkman Klein Center at Harvard University.
"We are in this sorry and deteriorating state because there is almost no cost to a manufacturer for deploying products with poor cybersecurity to consumers," said Dr. Fu. He later added "also there's no benefit if they deploy something with good security."
"The market can't fix this," said Schneier, because "the buyer and seller don't care ... So I argue that government needs to get involved. That this is a market failure. And what I need are some good regulations."
Rep. Greg Walden (R-OR), however, noted, that in prior cybersecurity-related hearings, experts routinely caution them that regulations can lead to organizations misallocating their security resources, and agile threat actors quickly changing attack methods. Walden asked "how do we create a national framework where the stakeholders are really driving this in real-time, and we don't do something stupid, like lock certain requirements into statute?"
Drew suggested beginning by establishing standards, and using them to apply pressure. Schneier suggested setting benchmarks, but not methods of achieving them. "Here is the result we want. Figure out how to do it," Schneier said.
Fu said, "Encoding mechanism would be unwise ... however principles I think you can encode." Fu also recommended incentivizing better cybersecurity hygiene, support for the National Science Foundation and NIST, and the establishment of an independent lab for pre-market cybersecurity testing (perhaps modeled off of safety programs like the National Highway Traffic Safety Administration).
Rep. Anna Eshoo (D-CA) introduced a cyber hygiene bill last October that calls for NIST to set standards, not Congress, because, she said "[Congress will] miss the mark, we'll miss it by a wide mile." Eshoo said the bill "has not gained a lot of traction" but that the statements made by the witnesses "puts some wheels on it."
She was less hopeful, however, about the success about another recommendation made by Schneier: the establishment of a new government agency.
Schneier said: "We can't have different rules if the computer has wheels, or propellers, or makes phone calls, or is in your body. That's just not gonna work. These are all computers and we're gonna have to figure out rules that are central."
He later held up his mobile phone, saying "It was ok when [this] was fun and games. Already there's stuff on this device that monitors my medical condition, controls my thermostat, talks to my car. I've just crosesed four regulatory agencies ... This is gonna be something that we're gonna need to do something new about. Like many new technologies of the 20th century, new agencies were created -- trains, cars, airplanes, radio, nuclear power. My guess is this is going to be one of them."
Eshoo however, felt that a Republican majority in Congress would make this difficult. "New agencies, new regulations, we're dead in the water," she said. "But we can't leave this issue to be dead in the water. Our country deserves much better."
Rep. Frank Pallone (D-NJ) asked if regulation like that suggested by the expert witnesses today might stifle innovation.
"Yes, it will," said Schneier. "And I don't like that, but in the world of dangerous things, we constrain innovation. ... I personally don't like killer robots. I think they're a mistake and we should regulate them."
"This is what we do when innovation can cause catastrophic risk," he said. "And it's catastrophic risk we're talking about. It's crashing all the cars. It's shutting down all the power plants. The internet makes this possible because of the way it scales. And these are real risks."
Fu said he worries "bureacracies" will get in the way of security. "I worry about the inability to change. I worry about being stuck saying 'we've never done it that way before.' I worry about saying things like 'well that's unprecedented.' Well, the Internet of Things is unprecedented. So there are going to have to be some changes." He compared it to the long path to making handwashing a habit. "It took 165 years before handwashing was common. It's going to take some time for security, but the time is right to do to do something right. To do something wise."
Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio
5 Emerging Cyber Threats to Watch for in 2019Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
How Enterprises Are Attacking the Cybersecurity ProblemData breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Enterprise Vulnerabilities From DHS/US-CERT's National Vulnerability DatabaseCVE-2019-9015 PUBLISHED: 2019-02-22
A Path Traversal vulnerability was discovered in MOPCMS through 2018-11-30, leading to deletion of unexpected critical files. The exploitation point is in the "column management" function. The path added to the column is not verified. When a column is deleted by an attacker, the correspond...
An XSS vulnerability was discovered in MOPCMS through 2018-11-30. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the form[name] parameter in a mod=column request, as demonstrated by the /mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&am...
In the Linux kernel before 4.20.2, kernel/sched/fair.c mishandles leaf cfs_rq's, which allows attackers to cause a denial of service (infinite loop in update_blocked_averages) or possibly have unspecified other impact by inducing a high load.
In the Linux kernel before 4.20.5, attackers can trigger a drivers/char/ipmi/ipmi_msghandler.c use-after-free and OOPS by arranging for certain simultaneous execution of the code, as demonstrated by a "service ipmievd restart" loop.
In Eclipse Wakaama (formerly liblwm2m) 1.0, core/er-coap-13/er-coap-13.c in lwm2mserver in the LWM2M server mishandles invalid options, leading to a memory leak. Processing of a single crafted packet leads to leaking (wasting) 24 bytes of memory. This can lead to termination of the LWM2M server afte...