Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Internet Of Things Security Reaches Tipping Point
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:30:43 AM
Re: Network access point
Good point--the existing not-so-secure devices need retrofitting. Not sure how this would be marketed, but maybe the automakers could provide an IPS in a recall, for instance. We'll see how it all unfolds.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:28:50 AM
Re: Network access point
good point, although there could be an after market for automobiles and high-end wearables. It's a brave new world! It sure will be interesting to watch it unfold...
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/15/2014 | 9:25:41 AM
Re: Network access point
This is all speculation, of course, but I would think the vendors would have to provide it since consumers shouldn't be expected to know they need to add this security feature, etc. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/15/2014 | 9:04:36 AM
Re: Network access point
Kelly, I think there definitely is an emerging market here, although I wonder if it will be targeted to consumers or manufacturers? Maybe both?
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/14/2014 | 1:25:18 PM
Re: Network access point
I wonder if this opens the door for a new generation of mini-security tools/apps that are built for IoT's requirements. Heck, Chris Valasek and Charlie Miller built a prototype IPS of sorts that plugs into a car and detects attacks. I'm not sure how quickly the iOT and consumer product vendors can clean up their buggy code, etc., so maybe there's a stopgap option here. 
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:13:58 PM
Re: Wow
Good strategy. If you are not connected there is no risk, confidentiality and Integrity are satisfied. However this also means security in general failed since we could not talk about third leg of security: Availability.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:10:15 PM
Re: Wow
I hear you. Low tech devices are main drivers for the security holes at the same time. They even found vulnerability in a flash drive, which is HW mainly, anything can happen from that point forward.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
8/14/2014 | 1:07:22 PM
Network access point
 

One way of avoiding problems that would be coming from IoT is to build a secure network and not allowing all these small devices connecting internet by themselves. This is what we do at work and home currently actually. What is important is to make sure there is only one gateway and that gateway is secured properly.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
8/13/2014 | 6:49:51 PM
Re: Wow
I have a fairly low-tech house and vehicles, so sadly, that makes me feel better. But most consumers have no idea that their smart thermostat, or their fully loaded vehicle could be compromised or used as a bot to attack others. They're having a tough enough time coming to terms with their PCs as targets. The security researchers who've explored weaknesses in consumer and other embedded devices are concerned about how this could play out. That's why it's promising to see I Am The Cavalry and BuildItSecure.ly, plus other outreach efforts. So don't unplug yet, Sara!
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/13/2014 | 5:45:52 PM
Re: Wow
Historically, manufacturers haven't gotten around to taking public safety seriously until they start losing product liability suits. The legal concept of "due care" should definitely be applied to the connected "things" that we use everyday and will be increasingly the target of hackers, criminals and other bad actors.
Page 1 / 2   >   >>


News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32094
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to upload arbitrary files.
CVE-2021-32095
PUBLISHED: 2021-05-07
U.S. National Security Agency (NSA) Emissary 5.9.0 allows an authenticated user to delete arbitrary files.
CVE-2021-32096
PUBLISHED: 2021-05-07
The ConsoleAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code (for an eval call) via the CONSOLE_COMMAND_STRING parameter.
CVE-2021-32098
PUBLISHED: 2021-05-07
Artica Pandora FMS 742 allows unauthenticated attackers to perform Phar deserialization.
CVE-2021-32099
PUBLISHED: 2021-05-07
A SQL injection vulnerability in the pandora_console component of Artica Pandora FMS 742 allows an unauthenticated attacker to upgrade his unprivileged session via the /include/chart_generator.php session_id parameter, leading to a login bypass.