Slashdot Mirror
Congress Introduces Bill To Improve 'Internet of Things' Security (cnet.com)
Members of the US Senate and House of Representatives introduced the Internet of Things Cybersecurity Improvement Act on Monday, hoping to bring legislative action to the emerging technology. From a report: Connected devices are expected to boom to 20.4 billion units by 2020, but they don't all have the same levels of security. Hackers often target IoT devices that don't have built-in security, leading to problems like default passwords and vulnerabilities that can't be fixed. [...] Lawmakers are looking to fix that with the bill, which would require a bare minimum of security standards for any IoT devices that the federal government uses. "While I'm excited about their life-changing potential, I'm also concerned that many IoT devices are being sold without appropriate safeguards and protections in place, with the device market prioritizing convenience and price over security," Sen. Mark Warner, a Democrat from Virginia, said in a statement.
Best case, they require a password to admin accounts. Worst case, jeez, I can't imagine. We'll start with IoT vendors who pay the most $$$ to re-election campaigns. And go downhill from there.
Hackers often target IoT devices that don't have built-in security, leading to problems like default passwords and vulnerabilities that can't be fixed. [...] Lawmakers are looking to fix that with the bill, which would require a bare minimum of security standards for any IoT devices that the federal government uses.
This will become nothing more than special "government edition" and "consumer edition" product lines of the exact same item, just with different firmware. Remember the $600 hammer? Now there will be an actual justifiable difference between the product bought on government contract and the same item at a fraction of the price at Wal-Mart.
Worst case will be some senators getting some nice backhanders for supporting this.
Oh, hang on that's just business as usual.
Best government money can buy all right.
Who here wishes the fuck we had a goddam act of Congress to establish best practices during our IT careers?
THEN we could have said, "Security -- it's not just a good idea, it's the law!"
It little behooves the best of us to comment on the rest of us.
admin/admin is not to be used as a default factory set name and password?
Stickers printed with every device showing its own unique name and long, complex and very unique password?
Domestic spying is now "Benign Information Gathering"
The "S" in "IoT" stands for "Security". As in, there ain't none.
Yes, having a default password already applied to all IoT devices would be a great idea, as long as the instructions on "HOW TO CHANGE THE DEFAULT PASSWORD" was printed in at least 24-point type. For appliances, the instructions should be printed on a sticker (same typeface) across the front of the device.
Beyond that .... the users need to be afraid of IoT devices and be concerned that they could he hacked. Because they all will be.
It'll be watered down to pointlessness by the time it passes anyway, like most of these bills usually are. As long as it doesn't override the California law, which again these bills usually do, things should be OK though, at least that has some teeth. The CA one is still pretty weak, but at least it's something.
Almost certainly this will be a checklist, like PCI DSS compliance for credit card processors. Just like it is there, it will ensure you have a lock on the door, the window is closed, and a fence is around the perimeter... but does nothing to ensure the fence isn't made from tissue paper or that there isn't a large gap in the wall right next to the door.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Knowing the current state of Congress, they're require a third-party auditor to "certify" all new IoT products before allowing their sale in the US.
The list of third-party auditors will probably closely match the list of corporate donors who sponsored the bill.
I'm sure that the open source people will love jumping through this extra regulatory hoop and paying the required fees toll before getting their product on the market.
This will be watered down to the point where all it says is "Every internet-enabled appliance should have a password for security. The official credentials are scott/tiger".
Enjoy.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Because the environment and requirements of a refrigerator change constantly? If an appliance needs a software update, you're not a customer; you're a beta tester.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
No it's a buzz word. Network devices or internet devices would be the correct term. "Internet of Things" is not.
According to the article, they're having NIST prepare the standards and controls, with a 5-year refresh. If this was the legislators coming up with standards, as they did with HIPAA, I think it would be doomed to fail. But NIST knows their stuff - the controls in Special Publication 800-53 rev 4 are pretty solid, and come with mappings for low, moderate and high security situations. Like FedRAMP for cloud providers, this will become a bar for entry into the public sector, and at this point, it has the potential for being a good one.
Knowing the current state of Congress, they're require a third-party auditor to "certify" all new IoT products before allowing their sale in the US.
If you read the bill instead of fabricate FUD, you'll see that it has nothing to do with approving anything for sale in the US, and that the "third party" is NIST.
The list of third-party auditors will probably closely match the list of corporate donors who sponsored the bill.
I did not know that NIST was a corporate donor to any political campaign.
I'm sure that the open source people will love jumping through this extra regulatory hoop and paying the required fees toll before getting their product on the market.
It has nothing to do with "open source" or getting a product on the market.
Reminds me of the whole 8570 CompTIA scam. Come pay us (forever) for this useless certification that the government is now going to require everyone who touches a government computer to have.
Just another day in Paradise