Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
11/9/2017
09:00 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

'Goldilocks' Legislation Aims to Clean up IoT Security

The proposed Internet of Things Cybersecurity Improvement Act of 2017 is not too hard, not too soft, and might be just right.

David Holmes contributed to this article.

Cybercrime in general — and most recently, crime perpetrated using IoT devices — has become a serious problem. Legislatures around the world have struggled to write laws to rein things in. The problem has been that governments have issued cybersecurity laws that are either too burdensome or ineffective.

We’ve seen various breach disclosure acts designed to "name and shame" organizations for their security failures in hopes that exposure will lead to better security. There have been presidential directives that seem to only reiterate the importance of security, suggest more study and cooperation, or rearrange government agencies. At the other end of the spectrum, we’ve seen very prescriptive, resource-intensive laws like GDPR and HIPAA mandating large infrastructures of security controls, policies, and reporting.

Now in the US we’re seeing "Goldilocks" proposed IoT legislation that’s not too hard, not too soft, and might be just right. It’s called the Internet of Things (IoT) Cybersecurity Improvement Act of 2017, proposed by Mark Warner (D-VA), Cory Gardner (R-CO), Ron Wyden (D-OR) and Steve Daines (R-MT).

Let’s take a closer look at its pros and cons.

The Power of the Government Purchase Order
For years, cybersecurity experts have been imploring the US government to clean up its own cybersecurity and use its mammoth buying power to push through new standards in security. A major component of the new proposed legislation does this. Not only would this be a powerful way to raise the bar across the industry, it would also be easier to pull off than larger, more direct legal measures.

The bill would require the Office of Management and Budget (OMB) to develop standards for all agencies in its purview to develop specific contractual standards for IoT security.

Government-purchased IoT devices would need to:

  • Be free of known security vulnerabilities, as defined in the NIST National Vulnerability Database
  • Have software or firmware components that accept "properly authenticated and trusted" patches from the vendor
  • Use acceptable standards for communication, encryption, and interconnection with other devices or peripherals. This means that feeble old Telnet would not be acceptable as an administrative mechanism.
  • Not include any "fixed or hard-coded" credentials (that is, passwords) for remote administration, delivery of updates, or communications
  • Have notification and disclosure methods in place for discovered security vulnerabilities
  • Be patched or have security vulnerabilities removed in a timely manner

The legislation would also require government agencies to set inventories of IoT devices and update them every 30 days. Agencies would also be required to publicly disclose which IoT devices have gone out of support, and which have liability protections.

Considering that the US government is budgeted to spend nearly $85 billion (yes, that’s billion) in 2017 on IT, this proposed legislation casts a huge shadow across the industry.

Liberty to Do Research on Security Flaws
Another positive of this bill is that it would provide safe harbor for security researchers who have been under the chilling effects of the Computer Fraud and Abuse Act (CFAA). To recap, CFAA states a person is committing a crime if he or she accesses a computer without authority and causes harm. Unfortunately, this act, which began with good intentions to ensure that computer crimes not go unpunished, has been used against security researchers who often uncover serious weaknesses in software, systems, and devices. As a result, CFAA has dampened efforts by researchers to find new security vulnerabilities before the bad guys do (and the bad guys just ignore this law, anyway).

Specifically, the bill would set up an exemption both in the CFAA and the Digital Millennium Copyright Act (DMCA) (which prohibits tampering with copyright restrictive mechanisms) for security researchers who test "in good faith" the security of any IoT device being used by a federal agency.

Note that the law doesn’t protect security researchers from being sued for libel if they publish false results. There’s already been at least one big dust-up regarding security vulnerability disclosure and libel around medical devices.

What’s Not So Great
One hard nut to crack is defining exactly what an IoT device is. This bill goes a little too gray in that area and scopes in all "Internet-connected devices" which are defined as "a physical object that…"

  • is capable of connecting to and is in regular connection with the Internet, and
  • has computer processing capabilities that can collect, send, or receive data.

This basically includes any computing device, far beyond IoT. It also calls into question any virtual or cloud-computing system. But do they really qualify?

A law wouldn’t be a law if it didn’t have exceptions, and this proposed law has several. For one, manufacturers can be waived from the requirements if they disclose known vulnerabilities, possible mitigations, and provide "a justification for secure use of the device notwithstanding the persisting vulnerability."

There are also exceptions for devices of "severely limited functionality" that would be "unfeasible" or "impractical" to secure to the requirements. Of course, any Internet-connected IoT device could still be subverted into a thingbot for DDoS attacks and other mayhem, regardless of its "limited functionality."

All in all, the proposed legislation is not bad. Let’s hope it passes. If not, manufacturers, without any accountability whatsoever, will continue to build vulnerable IoT devices. And government agencies and consumers will continue to purchase these vulnerable devices, many of which will inevitably become part of worldwide thingbots (like Mirai), used to pull off massive attacks like those seen in late 2016.

Get the latest application threat intelligence from F5 Labs.

 

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
White House Cybersecurity Strategy at a Crossroads
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/17/2018
Lessons from My Strange Journey into InfoSec
Lysa Myers, Security Researcher, ESET,  7/12/2018
What's Cooking With Caleb Sima
Kelly Jackson Higgins, Executive Editor at Dark Reading,  7/12/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
F5 makes apps go-faster, smarter, and safer. With solutions for the cloud and the data center, F5 technology provides unparalleled visibility and control, allowing customers to secure their users, applications, and data. For more information, visit www.f5.com.
Featured Writers
White Papers
Video
Cartoon Contest
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14332
PUBLISHED: 2018-07-19
An issue was discovered in Clementine Music Player 1.3.1. Clementine.exe is vulnerable to a user mode write access violation due to a NULL pointer dereference in the Init call in the MoodbarPipeline::NewPadCallback function in moodbar/moodbarpipeline.cpp. The vulnerability is triggered when the user...
CVE-2018-1529
PUBLISHED: 2018-07-19
IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through 6.0.5 and IBM Rational Requirements Composer 5.0 through 5.0.2 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potential...
CVE-2018-1535
PUBLISHED: 2018-07-19
IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri...
CVE-2018-1536
PUBLISHED: 2018-07-19
IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri...
CVE-2018-1585
PUBLISHED: 2018-07-19
IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.5 and IBM Rational Software Architect Design Manager 5.0 through 5.0.2 and 6.0 through 6.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alteri...