5 ms·

how many years until iot manufacturers get sued for producing insecure devices?

wiredfool 10y ago
Good luck finding that vendor on Ali-express or Amazon.
blunte 10y ago
I think the reason we have such bad security is that non-technical end users just don't care. You can try a dozen different approaches to getting them to care about security, but they often cannot be bothered with it. Thus, if you want to go the legal/penalty route, you need to sue the end users. The entity that owns the house/office that installed the unpatched CCTV camera is effectively responsible for the behavior of that camera. If they then want to shift the responsibility to the manufacturer, that's their choice (and effort). What it will do is make users consider a bit more carefully when choosing devices and manufacturers, and it will make manufacturers have to consider (and promote) their security and patching practices to maintain marketshare.
- ge0rg 10y ago
  I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC). What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]: Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...] [0] https://www.schneier.com/blog/archives/2016/07/real-world_secu.html https://www.schneier.com/blog/archives/2016/07/real-world_se...
  - icebraining 10y ago
    I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. The same way they do for everything else. Ask experts. Demand third-party reviews. Require warranties for security flaws.
  - di4na 10y ago
    Want an answer? The real one? Let corporations attack each other via electronic attack. It will be far worse at the beginning. But once you really threaten the bottom line for free, security will come. I sadly see no other good way to have security in software.
  - eternalban 10y ago
    http://www.ul.com/newsroom/pressreleases/ul-launches-cybersecurity-assurance-program/ http://www.ul.com/newsroom/pressreleases/ul-launches-cyberse...
- throwaway1974 10y ago
  Suing users wont work, now suing the manufacturer if the device is possibly a path that we will see pursued. If a precedent is set (after all cars get recalled all time for flaws) then we would endup with a more secure internet.
- throwaway-hn123 10y ago
  In the same way we sue users for purchasing cars that get recalled, Samsung Galaxy 7 Note, etc etc? This is not a user issue. Manufacturers need to issue recalls and be made liable for shipping insecure by default products.
zcam 10y ago
Not gonna happen. Think of all the insecure windows "devices" out there. How do you draw the line.
- CodeWriter23 10y ago
  You draw the line by legally kicking the crap out of a smaller vendor, then they become an example for the bigger guys. Suddenly the industry-wide Cost:Benefit analysis changes such that it is less costly to secure the devices they sell.
  - zcam 10y ago
    It's not all black/white. Nobody is immune to this problem, even with best efforts/practice, saying "let's sue to death small vendors so that big one react" is kind of ridiculous. Again, it's hard to draw a line.

Good luck finding that vendor on Ali-express or Amazon.

I think the reason we have such bad security is that non-technical end users just don't care. You can try a dozen different approaches to getting them to care about security, but they often cannot be bothered with it. Thus, if you want to go the legal/penalty route, you need to sue the end users. The entity that owns the house/office that installed the unpatched CCTV camera is effectively responsible for the behavior of that camera. If they then want to shift the responsibility to the manufacturer, that's their choice (and effort). What it will do is make users consider a bit more carefully when choosing devices and manufacturers, and it will make manufacturers have to consider (and promote) their security and patching practices to maintain marketshare.

ge0rg 10y ago
I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC). What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]: Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...] [0] https://www.schneier.com/blog/archives/2016/07/real-world_secu.html https://www.schneier.com/blog/archives/2016/07/real-world_se...
- icebraining 10y ago
  I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. The same way they do for everything else. Ask experts. Demand third-party reviews. Require warranties for security flaws.
- di4na 10y ago
  Want an answer? The real one? Let corporations attack each other via electronic attack. It will be far worse at the beginning. But once you really threaten the bottom line for free, security will come. I sadly see no other good way to have security in software.
- eternalban 10y ago
  http://www.ul.com/newsroom/pressreleases/ul-launches-cybersecurity-assurance-program/ http://www.ul.com/newsroom/pressreleases/ul-launches-cyberse...
throwaway1974 10y ago
Suing users wont work, now suing the manufacturer if the device is possibly a path that we will see pursued. If a precedent is set (after all cars get recalled all time for flaws) then we would endup with a more secure internet.
throwaway-hn123 10y ago
In the same way we sue users for purchasing cars that get recalled, Samsung Galaxy 7 Note, etc etc? This is not a user issue. Manufacturers need to issue recalls and be made liable for shipping insecure by default products.

zcam 10y ago

Not gonna happen. Think of all the insecure windows "devices" out there. How do you draw the line.

CodeWriter23 10y ago
You draw the line by legally kicking the crap out of a smaller vendor, then they become an example for the bigger guys. Suddenly the industry-wide Cost:Benefit analysis changes such that it is less costly to secure the devices they sell.
- zcam 10y ago
  It's not all black/white. Nobody is immune to this problem, even with best efforts/practice, saying "let's sue to death small vendors so that big one react" is kind of ridiculous. Again, it's hard to draw a line.