Slashdot Mirror
Congress Introduces Bill To Improve 'Internet of Things' Security (cnet.com)
Members of the US Senate and House of Representatives introduced the Internet of Things Cybersecurity Improvement Act on Monday, hoping to bring legislative action to the emerging technology. From a report: Connected devices are expected to boom to 20.4 billion units by 2020, but they don't all have the same levels of security. Hackers often target IoT devices that don't have built-in security, leading to problems like default passwords and vulnerabilities that can't be fixed. [...] Lawmakers are looking to fix that with the bill, which would require a bare minimum of security standards for any IoT devices that the federal government uses. "While I'm excited about their life-changing potential, I'm also concerned that many IoT devices are being sold without appropriate safeguards and protections in place, with the device market prioritizing convenience and price over security," Sen. Mark Warner, a Democrat from Virginia, said in a statement.
Best case, they require a password to admin accounts. Worst case, jeez, I can't imagine. We'll start with IoT vendors who pay the most $$$ to re-election campaigns. And go downhill from there.
Well no shit. I should hope so. That needs a bill?
Possibly this is some kind of training issue. Given there have been no issues here, I don't think it's unreasonable.
Get fucked. The "internet of things" is not a real thing. Consumer goods and other bullshit shouldn't be connected to the internet.
Adding surveillance to everything isn't socially useful, and just gives away even more power to surveillance capitalists.
Hackers often target IoT devices that don't have built-in security, leading to problems like default passwords and vulnerabilities that can't be fixed. [...] Lawmakers are looking to fix that with the bill, which would require a bare minimum of security standards for any IoT devices that the federal government uses.
This will become nothing more than special "government edition" and "consumer edition" product lines of the exact same item, just with different firmware. Remember the $600 hammer? Now there will be an actual justifiable difference between the product bought on government contract and the same item at a fraction of the price at Wal-Mart.
Worst case will be some senators getting some nice backhanders for supporting this.
Oh, hang on that's just business as usual.
Best government money can buy all right.
Go back to your fields.
Let's ban more Chinese stuff because we cant compete or hack it as easily.
NSA
Who here wishes the fuck we had a goddam act of Congress to establish best practices during our IT careers?
THEN we could have said, "Security -- it's not just a good idea, it's the law!"
It little behooves the best of us to comment on the rest of us.
this bill won't go anywhere. some moron will throw in an amendment that mandates backdoors... so at best, we have status quo, at worst, we have an even bigger problem.
cannot figure out how to win against Huawei and build secure equipment it on its own, demand and supply be damned :)
admin/admin is not to be used as a default factory set name and password?
Stickers printed with every device showing its own unique name and long, complex and very unique password?
Domestic spying is now "Benign Information Gathering"
That'd be lovely. The feds demand some kind of fake not-actually-encrypted crypto, while Congress demands actually crypto crypto to secure IOT
The "S" in "IoT" stands for "Security". As in, there ain't none.
Yes, having a default password already applied to all IoT devices would be a great idea, as long as the instructions on "HOW TO CHANGE THE DEFAULT PASSWORD" was printed in at least 24-point type. For appliances, the instructions should be printed on a sticker (same typeface) across the front of the device.
Beyond that .... the users need to be afraid of IoT devices and be concerned that they could he hacked. Because they all will be.
It'll be watered down to pointlessness by the time it passes anyway, like most of these bills usually are. As long as it doesn't override the California law, which again these bills usually do, things should be OK though, at least that has some teeth. The CA one is still pretty weak, but at least it's something.
It is already watered down from conception. The summary says the law would only apply to IoT devices used by the USA federal government.
It's completely useless. Anyone selling IoT to them probably already does a decent job with security.
Real updatability is what is needed. Today we have two options
1) Continous updates with all new and cripling functionality
2) No updates at all
We need a third, possibly forced, option where only security patches are allowed
Almost certainly this will be a checklist, like PCI DSS compliance for credit card processors. Just like it is there, it will ensure you have a lock on the door, the window is closed, and a fence is around the perimeter... but does nothing to ensure the fence isn't made from tissue paper or that there isn't a large gap in the wall right next to the door.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Just build a yuge wall around all of IoT, with fire, and make all the shitty manufacturers and consumets pay for it.
We keep forgetting that we need laws to stop companies from F'ing the consumer with a knife.
Yes they will "legislate" this.
1) Propose a bill (written by the IoT vendors) that pretty much allows the vendors to lock users out of their products AND PROMISES SOME PROTECTIONS.
2) Tout the bill as the Safeguard for the FUTURE OF THE INTERNET
3) Tack on all sorts of riders for other interests
4) Pass it with BIPARTISAN support (because it is meaningless)
5) Give it to the FCC to "enforce" with no attached budget
Yep. Legislation at its finest.
"...with the device market prioritizing convenience and price over security," Sen. Mark Warner, a Democrat from Virginia, said in a statement.
That's the whole idea, Senator. Get with the times, will ya!
How about banning IOT, in children's toys (& companies using them to collect valuable info from children & even try to manipulate them)?
How about banning IOT, for anything that is not really need it (& the manufacturing company actually using it to collect valuable info from general public)?
They actually put "Internet of things" in the title, cant even get more lame and inept than this, America.
Knowing the current state of Congress, they're require a third-party auditor to "certify" all new IoT products before allowing their sale in the US.
The list of third-party auditors will probably closely match the list of corporate donors who sponsored the bill.
I'm sure that the open source people will love jumping through this extra regulatory hoop and paying the required fees toll before getting their product on the market.
This will be watered down to the point where all it says is "Every internet-enabled appliance should have a password for security. The official credentials are scott/tiger".
Enjoy.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
According to the article, they're having NIST prepare the standards and controls, with a 5-year refresh. If this was the legislators coming up with standards, as they did with HIPAA, I think it would be doomed to fail. But NIST knows their stuff - the controls in Special Publication 800-53 rev 4 are pretty solid, and come with mappings for low, moderate and high security situations. Like FedRAMP for cloud providers, this will become a bar for entry into the public sector, and at this point, it has the potential for being a good one.
Knowing the current state of Congress, they're require a third-party auditor to "certify" all new IoT products before allowing their sale in the US.
If you read the bill instead of fabricate FUD, you'll see that it has nothing to do with approving anything for sale in the US, and that the "third party" is NIST.
The list of third-party auditors will probably closely match the list of corporate donors who sponsored the bill.
I did not know that NIST was a corporate donor to any political campaign.
I'm sure that the open source people will love jumping through this extra regulatory hoop and paying the required fees toll before getting their product on the market.
It has nothing to do with "open source" or getting a product on the market.
Reminds me of the whole 8570 CompTIA scam. Come pay us (forever) for this useless certification that the government is now going to require everyone who touches a government computer to have.
Just another day in Paradise