4 ms·

Maybe there should be some kind of IoT security standards or maybe some Security Company testing and handling "Secure IoT device" rubber stamps to every tested

by trm42 11y ago

Maybe there should be some kind of IoT security standards or maybe some Security Company testing and handling "Secure IoT device" rubber stamps to every tested and compliant device? This is because every company that has been making "Things" for the last 5-100 years are now thinking about making IoT devices without understanding anything about Internet or Security. The Nissan Leaf or that toy maker Vtech cases are good examples of this. A Quick starter for the rubber stamp list: 1. Authenticate every request 2. Use encryption in every phase (transport, passwords etc) 3. Really, handle basic Web security 4. Be really, really protective about your customers data in every way 5. Don't sell the data without consent from the customer

jerf 11y ago
Step 0: Do a cost/benefits analysis of your network connectivity, taking into account the risks of doing it wrong and the expense of doing it right, plus the support pain of doing it right but still having to deal with dodgy home network support calls, and figure out if it's even worth it. Networked cameras do make sense to me, but a lot of the IoT stuff I see, if one really takes into account the full range of costs and benefits, are quite absurd propositions.
CaptSpify 11y ago
Although I agree with your premise, I don't know if it would work out. Look at PCI compliance nowadays: it's all bullshit. PCI is really there for the bank to pass the buck when something goes wrong. It pretends that it's making things more secure, but IME, it does not. I don't know the answer to this problem though
- trm42 11y ago
  Don't have any experience with PCI compliance but I assume this kind of stuff _should_ remove the most idiotic security holes.
  - CaptSpify 11y ago
    You'd think so, and it's supposed to. IME: As long as your not audited, nobody cares. I know of a place that was PCI approved for over 3 years that was doing every single item on the "do not do list". Since they weren't audited, nobody cared.

by trm42 11y ago

jerf 11y ago

Step 0: Do a cost/benefits analysis of your network connectivity, taking into account the risks of doing it wrong and the expense of doing it right, plus the support pain of doing it right but still having to deal with dodgy home network support calls, and figure out if it's even worth it. Networked cameras do make sense to me, but a lot of the IoT stuff I see, if one really takes into account the full range of costs and benefits, are quite absurd propositions.

CaptSpify 11y ago

Although I agree with your premise, I don't know if it would work out. Look at PCI compliance nowadays: it's all bullshit. PCI is really there for the bank to pass the buck when something goes wrong. It pretends that it's making things more secure, but IME, it does not. I don't know the answer to this problem though

trm42 11y ago
Don't have any experience with PCI compliance but I assume this kind of stuff _should_ remove the most idiotic security holes.
- CaptSpify 11y ago
  You'd think so, and it's supposed to. IME: As long as your not audited, nobody cares. I know of a place that was PCI approved for over 3 years that was doing every single item on the "do not do list". Since they weren't audited, nobody cared.