Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Schneier: It's Time to Regulate IoT to Improve Cyber-Security

eweek.com

Post reply on HN
Print view View original

31–40 of 185 posts

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#31

Post by Sophistifunk »

herf wrote: post #23

This is also a business model problem. Consumer hardware companies do not have the margin to make and support software that needs to run for ten years or more. Before the iPhone, software and hardware were often different and had different business models.

This is the big problem, and regulation can not fix it. If companies are expected to pay programmers and testers and support staff to keep their devices up-to-date, that money needs to come from somewhere, and cloud "services" that don't provide any value but exist only for MRR and lock-in are only going to result in a bigger attack surface and a bricked device when the company folds or loses interest.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#32

Post by ausjke »

Something similar existed called FIPS-140, though it is hard to certify and not a good fit for IoT.

IoT router/firewall might be one of the solution here, i.e. adding IoT pattern into existing routes/firewalls to protect IoT devices, in addition to your PCs and sometimes BYODs(smart phones etc).

It is very hard to make all IoT devices secure due to limited resource they have, so the first line of protection should be done on the router/firewall/gateway I think.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#33

Post by hw »

As we move towards a more decentralized future, it's hard to see governments controlling or regulating something like IoT.

Sure, the idea of billions of devices around the world connected somehow is scary, but government regulation is not the answer. If anything, regulation needs to be decentralized. More open source, community involvement with reviews and discussions, more self regulation

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#34

Post by AnimalMuppet »

Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> One thing that could kill the market is maybe making manufacturers liable for the damages caused by security holes in their devices, but regulation doesn't have to go that far to make an impact.

What reasonable case is there for making them not liable for the damages caused?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#35

Post by jstewartmobile »

IoT is a solution that has been looking for a problem for at least 20 years now. It's like every EE department in existence feels compelled to cram micros and ethernet into every toaster, thermostat and lightbulb.

I guess it only took this long for enough people to become insane enough to justify a market for it.

Preach on brother Bruce!

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#36

Post by AnimalMuppet »

herf wrote: post #23

This is also a business model problem. Consumer hardware companies do not have the margin to make and support software that needs to run for ten years or more. Before the iPhone, software and hardware were often different and had different business models.

Then maybe there isn't the economic case for making non-premium stuff that connects to the internet.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#37

Post by GrinningFool »

DanBC wrote: post #26
joe_the_user wrote: post #21

Earlier quoted context omitted.

Why would light bulbs need to be connected to the Internet for the use case of being turned on at a specific time? They'd just need to be connected to a timer for this. I mean, an Internet connected light bulb use-case would a bulb that flashed whenever a stock you owned went down in price, which is ridiculous despite being the least ridiculous example I could think of. IoT security cameras and an automated kitchen y…

> despite being the least ridiculous example I could think of. A lighbulb flashes when visitors ring the doorbell, which is useful for people with visual impairment. the doorbell has a hidden rfid reader, and certain guests have an rfid card. the doorbell flashes differently for each visitor.

That could also be done without network connectivity, even local. A microcontroller with a relay and rfid reader would do it. A fancier version might use bluetooth to let your phone set up new cards and disable/change others - still no need to talk to anything external beyond the phone itself.

Take it one step further, and you could trigger it via an NFC read of your vistors' phones. This also would not need to connect to a network (beyond installing the app on the phones).

Actually, sounds like it might be a fun project to play with :D

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#38

Post by leggomylibro »

MBCook wrote: post #28
leggomylibro wrote: post #8

Bullshit. What makes 'IoT' any different from an ordinary network-connected computer? You're either saying "it's time to regulate networked computing devices" or, "I want to carve out an easygoing regulation-free niche for MY product[s] to artificially excel in." I try not to be needleslly pessimistic, but this article has no definition of 'IoT' beyond 'networked computer with sensor', so three guesses as to which on…

I can easily update my Mac or my Windows PC. I also know that Apple and MS will be around for a while. How do I update my lightbulb? Who will make updates for? Maybe Phillips will for their product but what about smaller OEMs? What if the company quickly goes out of business like Juicero? Depending on what you buy and where you buy it do people even know who made it? Would you even know how to check for updates (assu…

You can, but you very well might not. And your desktop computer is a far, far more valuable target in terms of computing power and network connectivity. Should we be regulating that device as protection against your choosing or forgetting to not follow best practices?

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#39

Post by kbenson »

maltalex wrote: post #29
Asdfbla wrote: post #20

Even though many people scoff at the idea of government regulations, the economic incentives in IoT security are really all messed up and it's not really clear that the market will fix itself because so much of the damage can be externalized somehow. Does the manufacturer of a cheap and outdated IoT device care if it's participating in some ddos attack? Or like Schneier said, does the consumers care if they don't not…

> opening the source code once security updates for the device stop, so consumers could help themselves That might help the readers of HN, but not users in general. Most users won't bother installing security updates for their PC if it's not forced on them. Updating one's light bulbs with something off github is a non-starter.

It could help the market. It wouldn't be that hard to scan your local network and gather devices and firmware versions (if supported) or fingerprint them if all else fails, and compare against a database of known bad versions and provide weekly or monthly reports by email. I could see this being offered as a selling point of routers. AT&T and Comcast would almost definitely include support in their modem routers just for the extra protection it provides for their networks (and the extra data it gives them about every customer... I'm sure Comcast would love to know the number and types of Rokus and Fire sticks people had, if they aren't already doing this).

Edit: To complete the thought, it's not generally that hard to flash devices that support it, so a report that says "X,Y and Z have exploits, here are some options" could go a long way. Making devices support some minimum standard of local upgradability would help immeasurably.

Re: Schneier: It's Time to Regulate IoT to Improve Cyber-Security

#40

Post by fareesh »

May end up in a situation where the network layer of hardware and their respective wrappers/software is monopolized by a group of compliance savvy folks who have done the necessary audits, certifications, etc. In theory it is not necessarily bad, but regulations have a bad reputation because of how poorly these things are generally implemented.
Post reply on HN