3 ms·
Easier to say then do. Information security is different from electrical and material safety and the key difference is pace of technical progress. The latter ar
by ComodoHacker 10y ago
Easier to say then do. Information security is different from electrical and material safety and the key difference is pace of technical progress. The latter areas are relatively developed and stable, significant progress occurs in decades. While infosec landscape can drastically change in years and even months, within life-span of devices. To give you some perspective, toxicity of asbestos was discovered half a century after beginning of its widespread use [1]. And it took another half to fully realize the danger and stop using it.
When designing a new device, you can't mitigate a threat that you can't imagine. And you don't have enough time and budget (time-to-market is the key) to mitigate all known threats.
I'm not advocating status quo, which is dire. But there is no easy solution in sight.
1. https://en.wikipedia.org/wiki/Asbestos#Discovery_of_toxicity https://en.wikipedia.org/wiki/Asbestos#Discovery_of_toxicity
- blfr 10y agoThe crucial difference is that information security measures have to withstand a deliberate attack, not just predictable use or wear and tear.
- malka 10y agoThere is. Stop making useless networked devices. You dont have time and budget to mitigate threats. Then dont release.
- ComodoHacker 10y agoIf they were useless no one would buy them. They are indeed useful. The problem is they also can be harmful, but not to their users. The situation can be remotely compared to RF interference. If you use RF spectrum irresponsibly, you harm your neighbors, police, military and other parties, so everyone understands some regulation is needed. RF spectrum regulation is in everyone's interests. If you use insecure IoT devices, they are exploited to harm some abstract people on the other side of the globe, who cares about them? If more people realize their devices can be used to shut down their Twitter and Instagram, maybe something will change. But I personally doubt that.
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]