My larger point is that all the devices which were compromised had two things in common; they were consumer devices built on tight profit margins (hence the free/open source code) and the designers "hoped" that users would change the default password on the device when they were installed. So here we have have two failings of human beings (not technology); building cheap products and assuming end users understand technology and how to protect their own security. Couldn't see that coming.
So why is this fiasco such a tipping point in IoT history? Well first of all we all now know it can happen and affect a lot of other people who are going to take action, second, there is now no excuse for device designers not to take security seriously, even if they have a tight budget.
Just to show that this isn't wishful thinking on my part I have seen evidence of this in September when we (I was at AspenCore at that time) asked embedded/IoT hardware designers what their major concerns were right now and for the first time we saw Security as #1. Although one cautionary note is that "Cost" was #2 and very close.
So here is my closing thought, IoT security is on everyone's mind now and free software combined with asking users to change their passwords may not be the best choice for securing devices in a world of constant cyber attacks. More on this in my next blog and feel free to comment and share.
0 comments:
Post a Comment