9 ms·
U.S. Government Finally Gets Serious About IoT Security
- ipnon 6y agoCyber security should be seen as integral to national security as an army or navy. A cyber force is as necessary in the 21st century as a space force.
- _-david-_ 6y agoThere is already a cyber force. It is called Cyber Command https://en.m.wikipedia.org/wiki/United_States_Cyber_Command https://en.m.wikipedia.org/wiki/United_States_Cyber_Command
- Nicksil 6y agohttps://en.wikipedia.org/wiki/United_States_Cyber_Command https://en.wikipedia.org/wiki/United_States_Cyber_Command
- Rebelgecko 6y agoA unified command is different than an actual branch of the military
- TameAntelope 6y agoIs it actually important to have a dedicated branch? I legitimately don't know the benefits/drawbacks.
- ipnon 6y agoAs it is now, each service branch has their own cyber operations and command structure for them, and they are all beholden to the central cyber command for strategic coordination. But how the day to day is played out is determined by each branch by itself.
- Rebelgecko 6y agoThere's pros and cons so it depends on who you ask
- Orochikaku 6y agoThis is quite literally true for anything and everything and frankly adds nothing to this thread
- ethbr0 6y agoCyber anything isn't the solution. The solution is best practices, succinctly expressed, regularly updated, and loosely expressed but tightly enforced over years. Because tomorrow's device environment is not bought today. It's bought today-and-every-day-for-the-past-30-years. And securing the entire environment is the key goal.
- marshmallow_12 6y agoI would argue that it's orders of magnitudes more necessary than a Space Force. after decades of relatively slow advancement, i fail to see why it's vital in 2021 to dedicate an entire branch of the military to space. An area which they have virtually no access to. OTOH, cyber warfare is very real, available and probably more effective then anything short of nuclear warfare.
- PeterisP 6y agoThe problem with that is that practical cyber security is essentially about the "structural soundness" of a huge infrastructure that's mostly civilian and mostly private, about the resilience of private company internal systems and consumer products - a "cyber force" (no matter how strong or large) has neither authorisation nor practical ability to come in the servers and systems of every important private organization (some large, some quite small - e.g. municipal water infrastructure orgs whose "IT" is a contractor booked for a couple hours per week) and change them so that they'd be more defensible.
- realityking 6y agoInterestingly north Norway (https://en.m.wikipedia.org/wiki/Norwegian_Cyber_Defence_Force https://en.m.wikipedia.org/wiki/Norwegian_Cyber_Defence_Forc...) and Germany (https://en.m.wikipedia.org/wiki/Cyber_and_Information_Domain_Service_(Germany) https://en.m.wikipedia.org/wiki/Cyber_and_Information_Domain...) have created cyber branches in their armed forces as peers to the traditional Army/Navy/Air Force branches. I’m curious how this will play out.
- psychlops 6y agoThis law delegates to the NIST any guidelines. The guidelines recommended can be found here: https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8259.pdf https://nvlpubs.nist.gov/nistpubs/ir/2020/NIST.IR.8259.pdf My casual quick read did not see any manufacturers being held liable for security breaches. It's not clear to me how serious the USG is being if there is still no fault for the ongoing mass breaches of privacy.
- vuln 6y agoIt's all theatre... Absolutely no teeth.
- ryandrake 6y agoYup, the doc seems to merely make optional recommendations, without enforcement, and only apply them to new devices (not ones already in the field). This is the USA’s way to “get serious” about something. It’s a nothingburger.
- systemvoltage 6y agoNIST cannot write and enforce law. They can only make recommendations.
- ryandrake 6y agoThat’s kind of the problem though. “Getting serious” apparently means punting the problem to a standards body that can’t write or enforce law.
- vmception 6y agoprotip: always ask "or else what" because a lot of laws do not have consequences codified, or they do but have delegated to an authority that cannot levy any consequence, like the Department of Commerce or in this cast the NIST sometimes this is intentional, not by any specific lawmaker, but relying on their and everyone else's inattentiveness.
- midasuni 6y agoIoT, the S stands for security.
- williesleg 6y agoYay! Now I can trust everything again!
- mvzvm 6y agoI worked on a product, in the IOT space, through a major Telco's research lab, that was meant for US Gov deployment. The things I saw...
- marshmallow_12 6y agoplease tell us. I'm listening
- supernova87a 6y agoI don't know how to phrase this idea but maybe someone here can give it more correct context? If I were in charge of administering MAC/IP/etc addresses that all the proliferating billions of devices were starting to overlap and become a huge noisy pond of traffic and vulnerability, one thing I might do is create classes of devices and different privileges to them. So instead of every device, from the most important supercomputer/network superhub, down to dumb refrigerator on wifi, having equal priority and "must be listened to" traffic, there would be tiers of who is allowed to take up what bandwidth, assert what privileges, etc. Otherwise, with the coming storm of devices it will truly be like a shouting match with every device having equal volume and possibility for being a risk to every other device. Of course in some ways a Raspberry Pi can act like a superhub in some respects, so I realize there's challenges on who would decide and how to implement many layers of detail. But is there any merit to this concept?
- jessaustin 6y agoThe hardest part seems to be when the device first appears. The firewall/switch/whatever network appliance has to decide to which class the new device belongs. You can't trust the device, because most devices, from light bulbs to set-top boxes, will just say they're in the class that deserves maximum "upload audiovisual surveillance from the family bathroom directly to our server" permissions. So, the network equipment can compare the MAC to an already-populated (how?) list, but MACs can be spoofed. Maybe the device could obtain a token that proves to which class it belongs? In that case you have to pass out tokens in a reasonable way...
- bopbeepboop 6y agoYou partition devices by class into VLANs and give different VLANs different features. Lightbulbs live on a different part of the network than your bathroom OnlyFans setup, which you should probably use Ethernet for. The lightbulb doesn’t have a way to plug itself into the OF filming rig, no matter how much it lies about who it is or what it does.
- jessaustin 6y ago
- seventytwo 6y agoAll it took was a president who wasn’t an asset of a foreign super power!
- Rebelgecko 6y agoMaybe I shouldn't feed the troll, but I'm curious about what you are trying to accomplish with your comment? Even though he's not the most popular president on HN it's totally fair of you to laud President Trump for signing the bill into law. But bringing up those claims about President Obama's legitimacy comes across as a non-sequitur at best. (edited to be a bit more constructive)
- consumer451 6y agoIoT devices are a distributed Trojan Horse that we didn’t just let through the gates, we actually paid for the privilege as well.
- afrcnc 6y agoI've seen this "getting serious about IoT security" reports since 2015. Spoiler alert: they're not.
- calibas 6y ago>NIST’s initial rules include today’s best practices, such as having an over-the-air device update program Weren't these kinds of automated updates the basis for the SolarWinds attacks?
- Rebelgecko 6y agoI don't think that's an inherent problem with OTA updates, just bad security practices
- Leherenn 6y agoIt's a trade-off. With OTA updates you increase your attack surface, but you make it more likely that the device is updated if needed.
- grey4228 6y agoAnyone has experience with the KNX standard?. Seems like the solution to all IoT woes. It's an international standard and widely used. Seems to be that only Europeans have heard of it. https://en.wikipedia.org/wiki/KNX_(standard) https://en.wikipedia.org/wiki/KNX_(standard)