The Mirai Botnet Is Proof the Security Industry Is Broken

    > the IoT industry doesn't spend a penny on security,

Citation sorely needed [and not to be found].

Not sure that solves the problem either, perhaps UK has more stringent laws, or perhaps the US does. But if it's not universal a sufficiently large market can still be exploited to attack another. The internet is global. We need global regulations.

I think it's erroneous to blame the security industry wholesale, tempting as it may be.

Let's set blame aside for now. What caused this botnet?

  - The tendency of IoT/smart-device vendors to eschew engineering discipline
  - The tendency of _all_ companies to eschew security as an optional extra
    rather than the cost of admittance to the marketplace
    - The historical tendency of big companies /not/ being burned to the
      ground after a massive hack makes security a lower priority to
      many businesses
  - The lack of a secure automatic update infrastructure (which also led to a
    recall), for which the vendor could have mitigated the vulnerabilities used
  - General ignorance about the risks associated with default/weak/hard-coded
    security credentials (e.g. passwords)

Now let's look at each line item and discuss possible solutions:

  + Regulation could help here. Require third party security assessments on
    IoT/smart devices to be sold? It's not the most elegant solution, but it
    would be a vast improvement over the current state of affairs.
  + This is a cultural problem that makes application security painful in
    every business vertical. It takes a lot of one-on-one communication to
    resolve. Seeing large companies lose their shirts over security negligence
    might change the conversation.
  + This is a huge problem for all software. (See link below.)
  + Education.

Regarding secure automatic updates: https://paragonie.com/blog/2016/10/guide-automatic-security-...

Now let's circle back to blame. What is the security industry responsible for? In my view:

  - Failure to communicate with other industries and professions,
    such as electrical engineering.
  - Failure to communicate with developers in general.
  - Failure to educate people outside the industry of our own
    conventional wisdom.
  - Failure to learn the challenges that others are trying to overcome
    so security can be on the same team rather than yet another obstacle.

Through the blog posts on my company's website and a concerted effort to clean up Stack Overflow, I've been trying to educate PHP developers about better security practices for the past couple of years. It pays forward in spades. The rest of the security industry could do a lot of good if they did the same for their own respective communities.

The only problem with doing that is: There's no effective and ethical way to monetize it. I make more money from helping e-commerce sites recover from being hacked by easily preventable mistakes than I ever have from making the software that powers 30% of the Internet more secure. https://paragonie.com/blog/2015/12/year-2015-in-review

Solving the core problems is good for society, but society doesn't reward this behavior.

The security industry is broken because society is broken.

Toaster is required to pass safety standards because of the there is strong economic incentive (UL requirements) to do it. Without UL, it can't get on the shelf on any stores in US.

There are no such thing and UL security requirements for IOT device.

Time for such regulation?

But "internet + regulation" normally raise a lot of objections internally from the IT industry.

If someone (MSFT) proposes secure boot are required for all IOT devices, the first one to oppose it likely be EFF. :-)

But is IS dumb programmers (or more likely, dumb programmer management) causing this problem. Every IoT company has the same workflow: you take thing out of the box, hook up thing, use your smartphone to connect to thing with some app, and then it works. Everyone expects this experience and it's stupid because somewhere there is a hardcoded password.

This is made more asinine by the fact that we've had extremely easy to use methods of establishing trust between devices on a permanent basis, but because that would add three steps to the setup process the marketing people refuse to let it happen.

Nobody wants to spend the money to do it right, and nobody wants to spend the money on devices that do it right so here we are and I see no way out of this situation.