Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Security Experts Call For Regulation On IoT Cybersecurity
Threaded  |  Newest First  |  Oldest First
RickStaples
50%
50%
RickStaples,
User Rank: Strategist
11/17/2016 | 9:35:51 AM
The Market CAN and WILL fix this
--- "The market can't fix this," said Schneier, because "the buyer and seller don't care ... So I argue that government needs to get involved. That this is a market failure. And what I need are some good regulations." ---

I could not disagree more.  As a 30+ year IT professional I have seen security grow exponentially year over year.  Where was the regulation pushing it?  I don't know anyone who does not have some sort of firewall in their home.  A highly unregulated environment to say the least.  Security is on everyone's mind these days - both buyers and sellers.  I don't understand where Schneier gets the idea that the Free Market won't put substantial pressure to make things secure.  Reputation is everything in a highly competitive marketplace. And, consumer confidence (fear) is a significant driver.

Security is on everyone's mind these days - both buyers and sellers.  I don't understand where Schneier gets the idea that the Free Market won't put substantial pressure to make things secure.  Reputation is everything in a highly competitive marketplace. And, consumer confidence (fear) is a significant driver.

There is too much downside getting the Government involved and little or no upside that the Market can't manage.

IMHO

 

 
Bolgar
50%
50%
Bolgar,
User Rank: Apprentice
11/18/2016 | 6:21:33 AM
Re: Pending Review
Thank for your article !
anacrophobic
50%
50%
anacrophobic,
User Rank: Apprentice
12/2/2016 | 3:07:10 AM
Re: The Market CAN and WILL fix this
I think you're missing the depth of what they're saying.  It's not that companies and consumers aren't motivated toward security when they're aware that they need it, it's that companies and consumers aren't aware that they need it.  When someone's hacking your fridge, they're not doing it to negatively impact you, they're doing it to install a botnet, or piggyback off of it to other parts of your network.  These are invisible threats the consumer doesn't see and will never complain about.  Because they'll never complain about it, there's no reputation or market impact to the manufacturer for not doing security.  And because there's no positive market incentive for the manufacturer to properly secure their devices, many won't.  Some larger companies will, only because they've already made the investment in expertise to create other secure devices, but smaller companies won't because there's no positive market reinforcement and a huge negative market reinforcement in terms of cost to build proper security.

Cell phones are a good example, even though I don't generally consider them a part of the "Internet of Things".  Android phone manufacturers could create drivers for their old hardware for newer versions of Android, and Carriers could push OS updates (with those drivers) to older handsets to patch security holes and generally improve security.  But... why would they?  If they did, consumers might start keeping their older handsets longer, as they'd get the features of the new Android OS without having to upgrade.  Sure, they might be wowed by new bells and whistles on the phone, but the new OS is still a draw for some consumers.  So why would the free market encourage manufacturers and carriers to work together to make less money?

The only way this changes, honestly, is if high profile attacks with immediate and visible negative impacts for consumers start to occur.  That would create the consumer drive to implement better security, which would create the Brand Reputation impacts necessary to make security a good thing, rather than a bad thing, for the company's bottom line.  But until the consumer sees the negative impacts of an insecure Internet of Things, securing those devices will remain too expensive for the company.  If you can't quantify how your increased security will improve the company's bottom line, chances are you'll probably not get the management buy-in required to implement your mitigations.  After all, even larger companies have other things, even other security-related things, to spend that money on.
sonam11
50%
50%
sonam11,
User Rank: Apprentice
4/1/2019 | 9:59:04 AM
Re: The Market CAN and WILL fix this
Thanks for the valuable information and insights you have so provided here.

 

 
sonam11
50%
50%
sonam11,
User Rank: Apprentice
4/1/2019 | 10:00:09 AM
Re: The Market CAN and WILL fix this
Thanks for the valuable information and insights you have so provided here.

 
Ehanson005
50%
50%
Ehanson005,
User Rank: Apprentice
11/17/2016 | 2:45:01 PM
Regulation is not the answer
Regulatiuon is not the answer.  The fact is most people dont realize that they are living in a world where they have a complex wired and wireless network inside their own home.  Long gone are the days were a person could be secure with a software firewall on their PC.  With the advent of wireless devices, tablets, phones, televisions etc... that all conntect to the internet through your home network a home firewall appliance is more necessary than ever.  This could be somthing built in to the existing cable or DSL modems and managed by the service provider.
Lily652
50%
50%
Lily652,
User Rank: Moderator
12/11/2016 | 1:17:15 PM
prayer times

This is the type of information I've long been trying to find. Thank you for writing this information. 



COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5607
PUBLISHED: 2020-07-10
Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2020-15001
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
CVE-2020-15092
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
CVE-2020-15093
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
CVE-2020-15299
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...