Slashdot Mirror
A "Public Health" Approach To Internet of Things Security
New submitter StewBeans writes: Guaranteeing your personal privacy in an era when more and more devices are connecting our daily lives to the Internet is becoming increasingly difficult to do. David Bray, CIO of the FCC, emphasizes the exponential growth we are facing by comparing the Internet we know today to a beachball, and the Internet of Everything future to the Sun. Bray says unless you plan to unplug from the Internet completely, every consumer needs to assume some responsibility for the security and overall health of the Internet of Everything. He says this might look similar to public health on the consumer side — the digital equivalent of hand washing — and involve an open, opt-in model for the rapid detection of abnormal trends across global organizations and networks.
Thanks.
IoT is a bad idea.
Don't assign responsability to my grandmother for patching kernels using interfaces made by hardware people.
It will be a cold day in hell before I will accept having to authenticate to a 3rd party outside my network to access or access data that my devices generate on someone elses servers or devices. When I am able to open ports in my own firewall and access my devices and data directly without having to ask someone elses permission then internet of things will be a go for me. Until then I'll be a technically savvy luddite.
Digital is, by definition, imperfect. Analog is the way to go.
.... do shit because they vast majority of consumers are stupid tech illiterate fucks.
Don't think so? Look at what happened to videogames when we allowed "the consumers to decide", the vast a majority of videogamers voted for locked down server back ended games totally corporate controlled because they had to get their fix.
The idea we should trust people to 'vote with their wallet' is fucking stupid, the vast majority of humanity is at chimp level intelligence and behavior when it comes to technology. Just look at facebook for instance. Facebook is basically signing over your data to the NSA and the powers that be thank you for being so stupid.
The human mind didn't evolve for these large complex societies so we shouldn't expect human beings to behave in any kind of intelligent or rational way.
every consumer needs to assume some responsibility for the security and overall health of the Internet of Everything
...we're doomed.
It strikes me that this is a bit unrealistic. The largest number of devices out there are designed for consumer use to consumer standards, which I think will mean massive security holes in the interests of quick to market and lowest prices. And the people that these are marketed to will not have even the smallest chance of keeping their devices cheap or noticing that anything is out of the ordinary until it is way to late. If you want a comparison to public health, think about the likelihood of an illiterate peasant in the 14th century having the slightest chance of escaping the black death other than by sheer luck, the chances of the village priest (who might be able to read) was not any better.
This is gibberish. lol.
"Malo periculosam, libertatem quam quietam servitutem." -- Jefferson
with this One Weird Trick
He says this might look similar to public health on the consumer side — the digital equivalent of hand washing
I'm pretty good about handwashing and personal hygiene. And it protects a lot of others.
But I live in a world of pigs, and I can't wash after everything I touch, so I ended up with (almost recovered now) ass-vomiting many times a day for the last few days.
Transfer that over to the IoT, and it won't be my practices that screw me over, it will be someone else that screws me over.
Like driving, it doesn't matter how safe a driver you are, if you drive on the same road with a bunch of dimwits texting on their phones barreling down the highway at you.
"Guaranteeing your personal privacy in an era when more and more devices are connecting our daily lives to the Internet is becoming increasingly difficult to do"
Waffle, how about designing 'computers' that can't be compromised by opening a malicious attachment or clicking on a malicious URL. ref
" every consumer needs to assume some responsibility for the security and overall health of the Internet of Everything." Consumers are trying to take some responsibility but when the consumer's own government does everything in their power to weaken encryption and other secure forms of communication over the internet what are consumers supposed to do. The government should be taking an active role in defining regulations and laws that help consumers remain "safe" on the internet, that includes the FCC. But that just isn't happening. So I say, reject the internet of things. Just don't buy into it.
Then your shit aint being bought nor coming in to my home!
it just means Facebook is fucked because it can't track your movements anymore and the NSA is fucked because your data is encrypted. Seriously, the technology does exists to protect your digital information but that would mean people couldn't spy on you and make money off you so easily.
I agree with you, but it misses the crud (my opinion) which is TFA. TFA claims that we are all responsible for being good citizens and policing the internet because IoT and such. Which is crud because it lacks a sense of reality. Bad guys do exist, and people do bad things, regardless of how the rest of society is living.
If what TFA said was true, simply agreeing to give banks the ability to build vaults would have stopped all robberies. Countries that have outlawed guns for citizens would be completely free of gun crimes. And those are two really simple examples, human nature extends well beyond this.
The answer is for anything on the Internet to be protected, and if it can't be protected it should not be on the Internet.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Instead of all the hand wringing about future issues why not do things that really can be done right now to make life better. For example if our government announced a policy of economic punishment for any nation failing to arrest foreign hackers and turn them over to US courts we could eliminate boat loads of E-crimes against American citizens. Why should we tolerate Russia allowing pools of hackers dedicated to stealing American bank accounts or credit cards? Or how about a severe penalty for anyone not using a certain phone suffix for any call relating to sales so that we could totally shut down telemarketing. If we force the owners into bankruptcy for allowing just one call without that suffix we will kill off that industry which is 100% crooked. We won't even hear the phone ring as such companies would be electronically blocked before getting to our homes or cell phones. Of even greater importance we know that allowing coal to be used kills tens of thousands of Americans each year so how do we prioritize wrong doings when we allow the coal industry to murder hearts and lungs and poison our land and rivers? With all of these wrongs deliberately allowed to exist just how excited can I get over future issues with the net of things?
Good fucking luck.
How much longer do we have to put up with this Internet of Things nonsense until it goes away?
"every consumer needs to assume some responsibility"
Really? When *I* go online, yes, I have to assume some responsibility.
I hold the "things" up to the same standard: when the "things" go online, *they* have to assume some responsibility. It's not my f***ing fault if my fridge wants to surf the web, it's the fridge's fault.
IoT creates a new market for the anti-virus and other security providers, namely the market of "IoT router" anti-virus, intrusion detection, network segmentation, isolation and management "solutions."
" and involve an open, opt-in model for the rapid detection of abnormal trends across global organizations and networks."
We need access to EVERYTHING EVERYWHERE. Poor guys must feel left out of the Three Letter Agency club, the premier members get all the fun stuff.
When they start making devices based on Genode, and can generate a Private/Public key pair for authentication by pushing a button, and share the public pair via a local web page... I'll be interested.
As long as these things are running some version of Linux, Windows or that ilk, they won't be secure, no matter how many updates and patches you apply vigorously.
What we need more is a base model of distrust.
The primary design error in networking was to trust other devices. If we had designed networking from the start under the assumption of malicious intruders, we would have things like "to do anything, you need a token that proves you're allowed to do it". It would be in the protocols.
On embedded devices, I want a networking stack that will cryptographically check all incoming packets, and at the lowest level discard them if they don't carry a valid token. Nothing gets even processed unless you are authorized to interact with the device.
Assorted stuff I do sometimes: Lemuria.org
No, it's your fault for bringing a device into your house that has the potential to be compromised and spread misery to others without knowing enough about how to maintain its security through patches and other available upgrades. If you can't determine if that device is secure enough, don't buy it. If the manufacturers see that security is important to their customers (in other words, bad security is starting to cost them money, which is the most important thing, forget that 'quality' or 'security' shit) they will clean up their act.
Of course, this is free-market fantasy. Idiots will keep buying the shiny without any understanding of the implications. But I disagree that you're totally not at fault or not responsible for keeping your shit up-to-date with patches etc. If you turn off Windows Update, and you get infected with malware, guess what? You're partially at fault for disabling the manufacturer's provided security.
Never underestimate the power of stupid people in large groups.
So basically I'm responsible, because I didn't write the firmware, and instead it was written by an idiot? Like someone who runs Windows, and is therefore able to turn off Windows Update because it exists in the first place, and could be the very channel which, by means of DNS cache poisoning and/or router compromise and/or BGP poisoning, was the means to infect the thing in the first place?
How about we hold the idiot who thought giving the fridge a routable address via NAT off the local network in the first place, so that they could market specific brands of milk via coupons sent to me when I'm running low on milk, was a good idea, responsible instead?
You are responsible for what you can do. Of course you're not responsible for the firmware, but you have a responsibility to update it if it needs it. Balance the benefits WU gives you versus the risk in shutting it off for the average mouth breather; you can't save everyone but the chance of a compromise through WU is much lower than the risk of running an un-patched Windows machine. Leaving WU in its default state is the responsible thing to do, and that's the kind of responsibility I'm talking about. I don't expect the average consumer to be able to find and patch zero-days, but I DO expect them to know enough to not click on "punch the monkey" ads on the web, to know enough to install an anti-malware program, to know enough not to open attachments from people you don't know, to not run pirated software downloaded from some site in Elbonia, and to generally not be a fucking idiot. This is a perfectly reasonable set of expectations. The people who cause issues for others are the ones who don't do all that, who click on every banner ad in sight like a crack-addicted monkey hitting a lever, who send money to Nigerian princes, and are generally stupid enough to make people wonder how they tie their shoes. These are also the people who buy the shiny without knowing anything about how it works.
And how about not buying the fucking fridge if that's the way you feel about it? Nobody's got a gun to your head (that I know about, anyway)
Never underestimate the power of stupid people in large groups.
This is not going to be reasonable or even possible when devices are using obfuscated or poorly documented protocols which is becoming more prevalent. The best that the consumer will be able to do is isolate every device from every other (with a VLAN switch or equivalent) and block all incoming connections.
For example with Windows 10 or Windows 7 and later with various updates, how is the consumer to know via traffic inspection what is normal expected traffic and what is not? Even if you shut off all of the privacy destroying features, Windows still generates traffic. How do you distinguish this traffic from other malicious traffic?
Thanks for the useful article. Despite the fact that there are many new blogs and many other internet projects launched every day I believe that the blog created now may be promoted and made popular. In order to become an expert in the niche and attract people you need to learn and grow constantly. People want to read bloggers who are developing to grow with them. http://www.cutelovestories.net...