3 ms·

I think the morality of this issue is extremely interesting. A single insecure IoT device isn't a problem at all, but in huge quantities they become a form of I

by runeks 10y ago

I think the morality of this issue is extremely interesting. A single insecure IoT device isn't a problem at all, but in huge quantities they become a form of Internet weaponry. Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place. This would be a sort of middle ground, giving consumers a minor annoyance rather than a bricked device, but still leveling the playing field between white hats and black hats. Perhaps adding a $1 bounty per device for the white hats, paid by the device manufacturer. Then the manufacturer would be forced to purchase insurance, who would want to look at the security of the software before giving a offer on the policy.

inetknght 10y ago
This insurance concept is and interesting idea, I think. Unfortunately, insurance is all about risk management. In layman's terms: why bother worrying about security when you can just buy insurance for it. Then they'll pick up the tab for any problems, right?
- imgabe 10y ago
  Insurance can be a powerful force for creating standards. Most of the building codes in existence were created by the insurance industry. The NFPA (National Fire Protection Association) was originally sponsored by a collaboration of insurance underwriters. [1] Insurers want to make sure that a building meets the code before offering insurance on it. If a building collapses or burns down and it is later shown that it was not built to code, the insurance policy will be void. I imagine similar incentives would hold for IoT security. The insurance would be contingent on the manufacturer following all available best practices to show that they did all they could to make the device secure. [1] http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa
  - Zenst 10y ago
    When I worked upon software for the oil industry for the building of oil rigs. The whole aspect of testing and insurance was very much key and Llyods of London have dedicated inspectors who would inspect and sign of parts as and when completed and without them, no insurance could be offered. So for large scale key area's you will find that insurance/reinsurance companies have more than actuaries giving values to a risk. It is in their interest after all, more so when large sums of money are equally at risk of theirs. AS for driving standards, yes, it happens. Though in some cases it happens after the horse has bolted. For example in the UK ALL insurance has a premium added to it to cover people who have high-risk properties subject to flooding and with many houses built upon flood planes in the 80's with low regard to risk of flooding than they should, then it is a sticky plaster solution that fixes a legacy issue that we all end up paying for. That is the concern with IoT and I do fear that a solution that see's everybody paying the premium to cover the issues of the past, will transpire either directly or indirectly.
- runeks 10y ago
  Insurance companies don't pick up tabs, they spread out risk, and make a profit in the end if they've calculated the right probability of failure. The insured parties, together, are paying the tab, plus the profit for the insurance company. Only by inspecting a device and its software can an insurance company calculate a reasonable estimate of the risk of breach, and thereby reduce the risk of unprofitably to a tolerable level.
- oliwarner 10y ago
  The incentive is the premium. That's going to be based on the technical crappiness of a product. It's not going to be affordable to cheapo-Chinese manufacturers, so they won't bother. Their products will remain cheap and people who don't know (or don't care) will keep buying it. If you want to make insurance "work" you need a system similar to roads, with every device registered and insured to connect. Now we have insurance companies deciding what we're allowed to run. I don't like this future.
Bartweiss 10y ago
> Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place. I think something comparable to this is going to be necessary. There's simply not enough pressure to fix devices otherwise. With IoT especially, we seem to have an ugly incentive structure where there's no motivation to improve security unless there are lots of high-profile failures (and perhaps attendant lawsuits) that create demand. White hat work is often prohibited and almost always disdained - we've all seen stories of disclosures being completely ignored. So we get bad security not because consumers don't care about flaws but because they never know the weaknesses are there.

by runeks 10y ago

inetknght 10y ago

This insurance concept is and interesting idea, I think. Unfortunately, insurance is all about risk management. In layman's terms: why bother worrying about security when you can just buy insurance for it. Then they'll pick up the tab for any problems, right?

imgabe 10y ago
Insurance can be a powerful force for creating standards. Most of the building codes in existence were created by the insurance industry. The NFPA (National Fire Protection Association) was originally sponsored by a collaboration of insurance underwriters. [1] Insurers want to make sure that a building meets the code before offering insurance on it. If a building collapses or burns down and it is later shown that it was not built to code, the insurance policy will be void. I imagine similar incentives would hold for IoT security. The insurance would be contingent on the manufacturer following all available best practices to show that they did all they could to make the device secure. [1] http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa http://www.nfpa.org/about-nfpa/nfpa-overview/history-of-nfpa
- Zenst 10y ago
  When I worked upon software for the oil industry for the building of oil rigs. The whole aspect of testing and insurance was very much key and Llyods of London have dedicated inspectors who would inspect and sign of parts as and when completed and without them, no insurance could be offered. So for large scale key area's you will find that insurance/reinsurance companies have more than actuaries giving values to a risk. It is in their interest after all, more so when large sums of money are equally at risk of theirs. AS for driving standards, yes, it happens. Though in some cases it happens after the horse has bolted. For example in the UK ALL insurance has a premium added to it to cover people who have high-risk properties subject to flooding and with many houses built upon flood planes in the 80's with low regard to risk of flooding than they should, then it is a sticky plaster solution that fixes a legacy issue that we all end up paying for. That is the concern with IoT and I do fear that a solution that see's everybody paying the premium to cover the issues of the past, will transpire either directly or indirectly.
runeks 10y ago
Insurance companies don't pick up tabs, they spread out risk, and make a profit in the end if they've calculated the right probability of failure. The insured parties, together, are paying the tab, plus the profit for the insurance company. Only by inspecting a device and its software can an insurance company calculate a reasonable estimate of the risk of breach, and thereby reduce the risk of unprofitably to a tolerable level.
oliwarner 10y ago
The incentive is the premium. That's going to be based on the technical crappiness of a product. It's not going to be affordable to cheapo-Chinese manufacturers, so they won't bother. Their products will remain cheap and people who don't know (or don't care) will keep buying it. If you want to make insurance "work" you need a system similar to roads, with every device registered and insured to connect. Now we have insurance companies deciding what we're allowed to run. I don't like this future.

Bartweiss 10y ago

> Imagine if white hats were given legal immunity to hack devices that are easy to hack (for some definition of "easy") and, for example, replace the firmware with something that flashes some red text reading "contact manufacturer for replacement", and simultaneously closing the security hole in of which they came in the first place. I think something comparable to this is going to be necessary. There's simply not enough pressure to fix devices otherwise. With IoT especially, we seem to have an ugly incentive structure where there's no motivation to improve security unless there are lots of high-profile failures (and perhaps attendant lawsuits) that create demand. White hat work is often prohibited and almost always disdained - we've all seen stories of disclosures being completely ignored. So we get bad security not because consumers don't care about flaws but because they never know the weaknesses are there.