3 ms·
I'm currently working at a startup (5 people full time) doing IoT devices. I am by no means a security expert; but as the primary software engineer (and being r
by bradstewart 10y ago
I'm currently working at a startup (5 people full time) doing IoT devices. I am by no means a security expert; but as the primary software engineer (and being rather afraid of the internet), I've assumed the role of "security guy."
While I've certainly spent time on getting everything to a point that's "secure enough" to let me sleep at night, that amount of effort has in no way jeopardized our business.
And it's really simple things that cover the vast majority of problems:
- Encrypt everything.
- Use unique certificates/keys for every device, no master keys.
- Have (and use) automatic update capabilities.
- Don't use default credentials anywhere for anything.
- Disable unused protocols/close unused ports.
After the initial setup work, we incur a (very) minor additional cost of manufacturing to provision unique keys instead of flashing identical images. That's it.
What this regulation would really do is extinguish a lot of the bullshit cheap/knockoff products coming out of China.
- sillysaurus3 10y agoIt's good that you secured your IoT device. But if this regulation were in effect, you would not be declared secure until you had a pentest. That means regardless of how much effort you put in, you'd need to pay a (relatively) massive amount of money.
- bradstewart 10y agoI guess the regulation wouldn't require a pentest in my mind, at least not for all classes of devices. Something along the lines of self-regulation/providing basic documentation that you've adhered to some set guidelines would be a good step in my mind. If you're found in violation of those guidelines though, by all means require a pentest going forward. I honestly haven't a clue whether or not that might work in practice though.