Slashdot Mirror
Cisco Offers $300,000 Prize For Internet of Things Security Apps
alphadogg writes "Cisco today kicked off a contest with $300,000 in prize money that challenges security experts around the world to put together ways to secure what's now called the 'Internet of Things,' the wide range of non-traditional computing devices used on the electric grid, in healthcare and many other industries. A Cisco SVP concluded his keynote at this week's RSA Conference by announcing what he called the 'Internet of Things Security Grand Challenge.' Christopher Young said the idea is 'a contest of experts around the world to submit blueprints' for how security issues created by the Internet of Things could be addressed. It's expected that up to six winning entries would be selected and the prize money awarded at the Internet of Things Forum in the fall."
give up on the whole "internet of things" idea as it's a loser from the get-go.
You can donate my 300 large to the EFF.
I want to keep my devices secure. This means: Let me control them. Don't require them to phone home, or to be connected beyond my local network if I don't want. If they need to talk to a server, let me run that server on my own locked down box in my own house. Let me replace the OS on the "thing", if I want, because I won't be able to trust yours, because you have every incentive to sell me down the river.
Unless I control what software is run, and what it talks to, then there can be no security for my "internet of things".
But you won't, will you? You didn't really want to know I can keep my "internet of things" secure. What you really wanted to know was: how to present a facade of broken security while data-mining me to hell.
Do not allow them to connect to anything. I know it sounds trivial, but sometimes the only remedy for "Doctor, when I do it hurts" is to stop doing
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
This is a job for an invention using custom microprocessor instruction sets that are keyed. For a start, see my patents : http://popularcryptography.blo... This is a digital bunker, safer than using RISC or CISC. KISC will allow ownership as a Keyed Instruction Set Computer.
If Cisco is offering prize money to secure the internet-of-things, it means that they have no idea how to secure it themselves...
What kind of combination of genius and moron do you have to be to solve a major security issue like this and then give it to Cisco in exchange for virtually nothing?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Great, we are on the verge of finding out where all the Wild Things are! Right?
This probably means Cisco does not have a really good plan or idea on how to secure IoT.
When you win the prize, be sure to go downtown and flash the cash in front of everybody. When you get beat up and robbed, use your leftover money to post a prize for "flashing your cash around town without getting beat up and robbed". If anybody says you shouldn't do that, casually dismiss them. They are not part of "the club".
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
I've always been suspicious of new appliances having powerline networking chips built-in to communicate with smart meters, or possibly beyond that. I'd really like to be able to install something on the lines leaving my breaker panel that acts like a firewall and blocks any kind of network communication over powerline.
I may submit a paper. I have to spend a couple of months writing the paper anyway, for school. I see no reason that I wouldn't send the already-written paper to Cisco and see if they send me back $70,000 and the recognition from the conference.
Its called IPv6 and uses the already existing security layers.
Turn it off.
Most devices that one would connect to the Internet of Things - IOT are mundane data, not peeps into ones life.
Temperature, humidity, wind, sun, rain, etc. None of these need security, so why bother?
Only the things that indicate some personal action, absence, presents like open/close door, walk down hall, would one want to be secret, use HTTPS.
Since most of the reporting will be mundane statistics the security is NOT needed, just us HTTP.
Cisco hasn't been able to secure _any_, not one single product of all of their product lines, and you think we want them to be at the center of the movement of "securing" that which would potentially have access to my entire house? No thanks.
The whole drive behind IOT isn't convenience, it's monetization of information.
The marginal cost of a "smart" device is much more than the marginal return selling such a device on its own merits. Either you jack up the price of the device to cover the gee-whiz features or you don't, but the only reason they don't is because they have figured out how to sell this info to someone else.
The Nest is a great example. I think the last 7 day programmable thermostat I bought might have been $50; the Nest is $249 from their online store. What, exactly, does the Nest do that my Honeywell model not do for $200? It may be able to vaguely predict occupancy and make adjustments, but the "dumb" Honeywell model pretty much covers this -- we get up, we leave the house, we come home, we go to bed at about the same time. There's so few use cases where automagic adjustment would make any sense (and many where it wouldn't work).
A smart fridge is one where there's almost no use cases that don't involve product/marketing tie-ins -- selling my use of tagged products to marketers.
The only way you're going to get IOT is if you either pay the freight for the intelligence or let the device sell your info.
Let's see... I'm going to trust that an appliance vendor, some of whom have yet to add an OS (Linux, Android, etc.) to their devices, will properly create the security for said IoT device? Cisco is clearly looking to become such a vendor, and I don't think they're prepared to deal with the consequences & unbelievably protracted support schedules--way longer than Microsoft's ~10 year lifecycle for Windows and Office. Ultimately, will my IoT fridge that I buy today continue to work properly 20+ years down the line or will it be pwned long before then? (I suspect the latter...)
The reality is that a company with no such device experience (e.g. Amana, Kenmore, etc.) may contract out the security portion of the firmware to Cisco, but will Cisco continue to support the device's security for decades to come? In reality, people don't replace their home appliances, HVAC systems, and security systems all that often... I doubt Cisco is putting out many security patches for their devices from 1994, or if anyone even has the experience (let alone the desire) to create patches today for Linux 1.1.x security holes...
Windows 3.1x calc: 3.11 - 3.10 = 0.00
Thanks for mentioning that. I'll check my school's policy.
I just looked at the policies for five universities. Four of the five explicitly acknowledged that students own their work. The fifth had a "copyright assignment" form that I didn't read, so that school may have tried to get copyright assigned for student works, or it may be like Yale, where SOME works be employees, done as part of their employment, is owned by the university.
Support? Why would they care?
We know from the pattern of "upgrades" that smart TVs get (i.e. none, or maybe one if there's a major bug) that once a manufacturer has your money any relationship has ended. We should expect no less from smart devices. They will work with whatever software/firmware they were released with and when that dies, gets corrupted, becomes obsolete or a hard-wired IP address disappears, you will basically have a brick. Or, if you're lucky. a brick that still has some manually selectable functions.
If smart devices *do* get all the security bells and whistles that appear to be de-rigeur, then it's unlikely they will even be hackable or user-upgradable when ther short, short lives come to their inevitable end.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
For my school, I have not found any policy by which they attempt to claim copyright, or a copyright assignment form I would have signed.
I also have not found any document in which they explicitly acknowledge that under law, copyright belongs to the (student) author.
Humidity levels can cause warranties to discharge and drop the value of your property.
This is really simple. If you have a smartfridge, don't install Android or Windows on it. Make it a device that would barely qualify as an ASIC that only does what it does. When was the last time someone said their handheld calculator got hacked? If all you need to do is list an inventory of things in your fridge and set temperatures of drawers, make an electronic device that does that and only that. DO NOT just use a pre-existing platform because it's easier. It's a guaranteed way to get hacked.
The particular Cisco forum gives an error notice, so I don't take them too seriously. I told them I intend to make an entry, not for a single thing, but for everything. I cobbled together a submission using paragraphs from my missives. With a hundred day effort I could launch a full proposal for Ingrid. If it would be better then, that I relocate back to Canada, I'm prepared to go. This interim challenge involves Artificial Economic Modelling not built on Capitalism but on a completely different mode altogether, one that involves AI security built into the core of every device. Belief regulated competition is the best way to develop AI. Not one of the fourteen constructs defining Antisemitism have been violated, however conflicts of interest must exclude any NWO supporters from developing this proposal. While in an actual mode of being or system such as Capitalism, our current one being paralleled by the study of Electrical Engineering's use of current electricity, when one is contemplating a new theoretical economic mode, competitions will not try to define money. Within such constraints, monetary reform is useless. However an inverse of current electricity exists as static electricity. This has a bad reputation, just like anarchists do, but harnessed into a workable economic model, paralleled by a Free World AI, Capitalism now has a competitor. During the competition phase, LIKE FERRARI v McLaren, emulated quantum pathways will be used to form agreements. Bitcoin-like conceptual single-payer blockchains will connect reasons for every use, eventually substituting all hierarchical power with a totality of information and the Will To Virtuality. This Cisco award should help complete enough of a proposal to secure a full sponsorship for the first $2.5m rebuild of the mature Ingrid Thought Processor, eventually to go into everything. Among all user groups, where there is about the same participation as Ice Hockey, are needed 9,000 clubs of 36000 members or so. In other words 1000 hardcore user groups each providing 36 programmers. Total funding would be around $2.5b putting it on par with Formula 1 racing. By a stroke of luck I have attracted a stalker. Because this stalker is resetting my router, this is making my 24/7 dynamic website disappear. I thought long and hard about how I can use this as a Dead Man's switch. I made a mental note to finish my Host Migration algorithm so it splits the 6 man cell monitoring my playlist station and migrates to a new host location, thus instantly creating a new fully functioning cell whenever I go offline. The reserve 3 cell mast must then promote from within enough free Live Clients, to support a new cadre of frozen clones which can be called on to thaw out and become active. Therefore the more I'm attacked the quicker it grows. This is all planned to go out to an expected free audience of 600 million AI clients with 12 million frozen clones feeding the transitional earnings through 600,000 professional members. Coordination is done by 50,000 low powered cognitive radio stations, complemented by six thousand broadcast servers, six for each 36man Language Team.
Argumentum ad Probabilitum
...this is a publicity stunt. 300k is the total price money, the highest an individual entry can win is 75k. Sorry, but the real experts expect amounts like that as payment, not as maybe-couldbe-whoknows price money.
So you'll have participants largely being the B class who need the exposure and publicity. That's fine. Maybe not for a general concept, though.
More importantly: What's so different about the "Internet of Things"? That's just the latest buzzword. It's still network-connected devices. Sure, they're basically embedded devices so you have to use tools with low resource demands, but it's not like we invented a completely new computing system. Strip the buzzword and what you're really left with is small computers built into stuff around the house.
Assorted stuff I do sometimes: Lemuria.org