{"id":3233,"date":"2017-11-16T11:37:38","date_gmt":"2017-11-16T16:37:38","guid":{"rendered":"https:\/\/antipaucity.com\/?p=3233"},"modified":"2017-11-16T11:37:38","modified_gmt":"2017-11-16T16:37:38","slug":"what-is-plan-b-for-iot-security","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=3233","title":{"rendered":"what is “plan b” for iot security?"},"content":{"rendered":"

{{Schneier}} has a recent article on security concerns for {{IoT}} (internet of things) devices –\u00a0IoT Cybersecurity: What’s Plan B?<\/a><\/p>\n

We can try to shop our ideals and demand more security, but companies don’t compete on IoT safety — and we security experts aren’t a large enough market force to make a difference.<\/p>\n

We need a Plan B, although I’m not sure what that is. Comment if you have any ideas.<\/p><\/blockquote>\n

There are loads of great comments on the post.<\/p>\n

Here’s the\u00a0start of some of my thoughts:<\/h6>\n

There are a host of avenues which need to be gone down and addressed regarding device security in general, and IoT security in particular.<\/p>\n

Any certification program could be good .. right up until the vendor goes out of business. Or ends the product line. Or ends formal support. Unless we go to a lease model for\u00a0everything<\/em>, you’re going to have unsupported\/unsupportable devices out there.<\/p>\n

We can’t have patches\u00a0ad infinitum<\/em>\u00a0because it’s not practical: every vendor EOLs products (from OSes to firearms to DB servers to cars, etc).<\/p>\n

A few things which would be good:<\/p>\n