RSA USAThe security industryknows the vast majority of Internet of Things devices haven’t got more than a fig leaf of protection.
Now the unlikeliest of folks are calling for new rules to safeguard devices: libertarians.
In a session today at the RSA security conference in San Francisco, Olaf Kolkman, the Internet Society’s chief internet technology officer, and Bruce Schneier, IBM Resilient’s CTO and the bloke who literally wrote the book on cryptography, found themselves in an unlikely alliance on the matter of IoT security.
Essentially, Kolkman has called for strict industry requirements to bring IoT security defenses up to scratch. Schneier, an anti-regulation libertarian, agrees, yes, it's time to draw up security regulations for internet-connected gadgets.
“A lot of us have been libertarian for years and don’t want regulation, but that won’t be an option when the internet crashes into the real world and people get killed,” Schneier said. “You can’t talk about regulation verses no regulation that ship has sailed. Now it’s about smart or stupid regulation.”
The industry has sleepwalked into this issue because it’s not in companies’ interests to do anything about security on IoT devices. Normal folkdon’t care about it (yet), and anything that adds to the unit cost of a device is being resisted by manufacturers.
The situation is analogous to that with cars in the 1950s, Schneier opined. Back then, cars seldom had seat belts and none had airbags, and customers didn’t demand that auto manufacturers install them. It took the US government, faced with rising death tolls on the roads, to insist on safety standards.
We’re facing a similar situation now, he said, and it’s not going to be long before we see the first deaths from people either using such devices to bring down large chunks of the internet or interfering with individual devices like smart cars and buildings.
Kolkman said he was certainly in favor of government regulation of IoT devices. At the very least, there needs to be a requirement that these devices can be updated and patched. In practice, once one major market goes down this route the rest will follow.
He pointed to data privacy laws in Europe, which can fine a company up to 4per cent of its global revenue if it breaks the rules. With similar IoT rules, manufacturers would most likely build to the rules as a standard to allow sales in the EU, and the rest of the world would benefit.
Moderator Craig Spiezle, president of the Online Trust Alliance, said that he had little faith in the current Republican administration’s appetite for introducing new regulations. But individual states could well take the lead.
“I’m hearing encouraging things on regulation of IoT devices in California,” he said. “California was the first state to come up with anti-spam and child protection rules. California will lead the way.”
Some in the audience didn’t want any compulsory policies. Alex Gantman, VP of product security engineering at Qualcomm, said that in his career he’d never seen a law that made IT equipment more secure in some cases, red tape had the reverse effect.
