New Bill Seeks Basic IoT Security Standards

> that vendors ensure the devices are free from known vulnerabilities when sold. > Under the proposal, an IoT device has a fairly broad definition, being described as “a physical object that is capable of connecting to and is in regular connection with the Internet;” and one that “has computer processing capabilities that can collect, send or receive data.”

What is the exact definition of "known vulnerability"? With very broad definition, that would likely prevent them from buying any computers equipped with Windows for good part of the year as while Microsoft is preparing a patch for some vulnerability (which may have been internally discovered).

With even more broad definition, it could prevent selling with Linux as well for similar reason (as one of the tens of thousand packages is likely preparing a patch).

If it means vulnerabilities where there's either 1) exploit 2) patch 3) detailed information available, it would likely be enough.

The headline seems a bit deceptive. No basic standard is set for IoT security, the government just started demanding a certain quality for their own purchases of IoT devices (i.e. not buying just any old IoT device):

> The IoT Cybersecurity Improvement Act of 2017 seeks to use the government’s buying power to signal the basic level of security that IoT devices sold to Uncle Sam will need to have.

If a large swarm of autonomous cars were taken over because of a software vulnerability, and were roaming the streets threatening people for charge-ups, would we hold the car manufacturer liable?

We’re experiencing this with IoT devices, except that “threatening” for a rogue IoT device means a denial-of-service attack (sending information over a network connection).

I only scanned the article but couldn't see whether it mentioned voting machines. How would this Bill affect the procurement of new /or maintenance for already purchased/ voting machines if at all?

> For example, the bill would require [...] that vendors ensure the devices are free from known vulnerabilities when sold.

This seems... logistically challenging. It kind of also seems like an invitation to release new, high-priced "only the government will buy these" devices frequently, since (a) new devices don't have known vulnerabilities yet, and (b) older devices do have known vulnerabilities, so the government won't be allowed to buy them. But the security of those new devices will be much worse than the security of older ones.

This looks like a solid bill. It doesn't force the market's hand; it just guides it using the government's purchasing power. (The CFAA fix for good-faith cybersecurity research is a welcome add-on, too.)