4 ms·
I think the reason we have such bad security is that non-technical end users just don't care. You can try a dozen different approaches to getting them to care
by blunte 10y ago
I think the reason we have such bad security is that non-technical end users just don't care. You can try a dozen different approaches to getting them to care about security, but they often cannot be bothered with it.
Thus, if you want to go the legal/penalty route, you need to sue the end users. The entity that owns the house/office that installed the unpatched CCTV camera is effectively responsible for the behavior of that camera. If they then want to shift the responsibility to the manufacturer, that's their choice (and effort).
What it will do is make users consider a bit more carefully when choosing devices and manufacturers, and it will make manufacturers have to consider (and promote) their security and patching practices to maintain marketshare.
- ge0rg 10y agoI can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (should) prevent electric appliances from burning down your house (CE) or from bringing down airplanes (FCC). What is (urgently) needed is a similar approach to mandatory IT security certification for IoT devices. This is also advocated by Bruce Schneier [0]: Security engineers are working on technologies that can mitigate much of this risk, but many solutions won't be deployed without government involvement. This is not something that the market can solve. Like data privacy, the risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public [...] [0] https://www.schneier.com/blog/archives/2016/07/real-world_secu.html https://www.schneier.com/blog/archives/2016/07/real-world_se...
- icebraining 10y agoI can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. The same way they do for everything else. Ask experts. Demand third-party reviews. Require warranties for security flaws.
- di4na 10y agoWant an answer? The real one? Let corporations attack each other via electronic attack. It will be far worse at the beginning. But once you really threaten the bottom line for free, security will come. I sadly see no other good way to have security in software.
- eternalban 10y agohttp://www.ul.com/newsroom/pressreleases/ul-launches-cybersecurity-assurance-program/ http://www.ul.com/newsroom/pressreleases/ul-launches-cyberse...
- throwaway1974 10y agoSuing users wont work, now suing the manufacturer if the device is possibly a path that we will see pursued. If a precedent is set (after all cars get recalled all time for flaws) then we would endup with a more secure internet.
- throwaway-hn123 10y agoIn the same way we sue users for purchasing cars that get recalled, Samsung Galaxy 7 Note, etc etc? This is not a user issue. Manufacturers need to issue recalls and be made liable for shipping insecure by default products.