Connect with us

Cybersecurity

Internet of Things Connected Devices Are Inherently Insecure, Say Tech Experts

Published

on

Screenshot of Steve Augustino, Partner at Kelley Drye & Warren

January 24, 2021 –Internet of Things  connected devices are inherently unsecure, said Scott Poretsky, director of security at Ericsson, speaking at a Federal Communications Bar Association event on Thursday.

Resolving the security risks is all the more pressing with the coronavirus pandemic having generated great interest in enabling people to work in situations without being physically present.

A major sector of growth in IoT technologies is in health care, with virtual telehealth appointments and devices connecting patients with their doctors.

Unlike the common smartphone, IoT devices are not built with the same general-interest purpose in mind. IoT devices such as a smart toothbrush are only built to do a specific task. Hence that enables a long battery life.

Because IoT devices are built with such specific tasks, they lack powerful processing power. That leaves them vulnerable. And limited processing power means IoT devices don’t have room for security features. Too many open ports and too few layers of security, including mass-produced factory password settings, are wide open to cyber-attacks.

Additionally, low-cost devices infrequently receive firmware updates and software patches to fix security threats leaving consumers helpless.

Users of IoT devices need to know and do more to protect themselves from cyberattacks. Legislation has been passed to boost cybersecurity for IoT devices, said Rafi Martina, senior policy advisor for Sen. Mark Warner, D-Virginia.

Warner introduced the now-passed Internet of Things  Cybersecurity Improvement Act. It requires the National Institute of Standards and Technology (NIST) to issue recommendations addressing secure development, identity management, patching, and configuration management for IoT devices.

Martina said vendors need to stop bad developer practices, close unnecessary open ports, and enhance support for security in devices that range from internet-connected home video cameras to light bulbs, doorbells and other home appliances.

According to the FCBA session description for the event:

A defining characteristic of the Internet of Things (IoT) is that devices are capable of communicating with each other and the world at large.  As these “always connected” devices are more broadly deployed and handle more complex tasks, protecting the security of these devices becomes more difficult.

Moreover, security is not the responsibility of any single entity in the ecosystem alone, requiring a layered approach to cybersecurity.  In this program, speakers will discuss what is being done by the industry and the federal government to improve cybersecurity in IoT.  We will discuss ways to establish transparency, traceability and trustworthiness in IoT ecosystems and the role the federal government plays in IoT security through the IoT Cybersecurity Act of 2020 and NIST’s Cybersecurity for IoT program, among others.

Born in China and adopted to American Fork, Utah, Reporter Derek Shumway graduated from Brigham Young University with a bachelor's degree in political science and a minor in international strategy and diplomacy. At college, he started an LED lightbulb company. word

Cybersecurity

Congress Must Avoid ‘Overly Prescriptive’ Incident Reporting To Avoid Missing Larger Cyberattacks

Too many reports could burden federal officials, said the executive director of the Alliance for Digital Innovation.

Published

on

Rep. Debbie Shultz
Rep. Debbie Schultz, D-Florida

WASHINGTON, January 11, 2022 — The executive director of an organization that pushes information technology reform in government testified Tuesday in front of the House Oversight committee that any incident reporting requirements that Congress is considering should not burden officials so much that they end up missing more serious breaches of cybersecurity.

Ross Nodurft of the Alliance for Digital Innovation told lawmakers studying the reform of the Federal Information Security Management Act, a 2002 law which implements an information security and protection program, that the amended legislation should consider keeping Congress abreast of incidents, but should be mindful of how it defines a security problem.

“As Congress considers defining major incidents or codifying vulnerability response policies, any legislation should be mindful of the dynamic nature of responding to cybersecurity challenges facing government networks,” Nodurft said. “If Congress is overly prescriptive in its definition of an incident, it runs the risk of receiving so many notifications that the incidents which are truly severe are missed or effectively drowned out due to thee frequency of reporting,” he said in prepared remarks.

The comments come on the heels of a year that included major cybersecurity attacks, including the attacks on software company SolarWinds, oil transport company Colonial Pipeline, which prompted a Senate hearing on the matter. The House Oversight committee released details of its investigation into some of the breaches in November.

The comments also come after lawmakers proposed new reporting requirements on companies. Those proposed laws would make it mandatory that small and large companies report incidents to the government so they can best prepare a response to protect Americans.

In July, Sens. Mark Warner, D-Virginia, Marco Rubio, R-Florida, and Susan Collins, R-Maine, introduced the Cyber Incident Notification Act of 2021, which requires federal and private sector cybersecurity intrusions to be reported to the government within 24 hours.

Cyber incident reporting was recently left out of a Senate bipartisan version of the National Defense Authorization Act.

Lead cybersecurity officials in government have been calling for mandatory breach reporting to government. Brandon Wales, executive director of the Cybersecurity and Infrastructure Security Agency, told the same Oversight committee in November that Congress should force companies to share that kind of information. Last summer, a Department of Justice official said he supports mandatory breach reporting.

In October, Secretary of State Antony Blinken announced the department intends to create a new cyber bureau to help tackle the growing challenge of cyber warfare.

Agency roles should be clarified

Rep. Debbie Schultz, D-Florida, talked about the varied organizations and institutions in her state that have been affected by cyberattacks and threats, including the Miami-based software company Kaseya, which experienced a major ransomware attack.

Schultz stated that there are two entities that are critical to federal cybersecurity: the Cybersecurity and Infrastructure Security Agency and the Office of the National Cyber Director.

Grant Schneider, senior director of cybersecurity services, Venable, said that the Office of the National Cyber Director acts as a conductor in the framework of FISMA. These organizations work with other organizations, such as the National Institute of Standards and Technologies, and the Office of Management and Budget.

With so many organizations, Nodurft explained how important it is for the roles within these organizations to be defined. He talked about how important it is for agencies to know where to turn to report cyberattacks. In part with this, he continued, agencies who “are proactively trying to mitigate their cyber risks” need clear reporting channels and clear areas of jurisdiction to go to for various issues.

According to Nodurft, these defined roles would “make it much easier for [agencies] to work together, to build a broader defensive structure.”

Continue Reading

Cybersecurity

Industry Participants Discuss Security, Benefits of Internet-Connected Devices

Experts weighed the benefits and risks of internet-connected devices.

Published

on

Harold Feld, Jennifer Manner, Eric Tamarkin, Katerina Megas, Melanie Tiano and Mike Bergman

WASHINGTON, December 8, 2021 – Wireless industry leaders debated the security and benefits of Internet of Things devices at an event on Tuesday.

Many in-home appliances currently on the market, such as washing machines and refrigerators, are connected to the internet, which opens it up to hacking.

During a Federal Communications Bar Association event Tuesday, Harold Feld, senior vice president of Public Knowledge, expressed concern over this trend in the consumer market.

Since prominent hacks of Colonial Pipeline and meat producer JBS USA occurred earlier this year, information has surfaced showing hackers may have gained access to the companies’ systems through vulnerabilities in their IoT devices.

Feld stated that for those concerned about security flaws in the appliances they buy, it is hard to find devices on the market that do not have internet connectivity. Further, he stated that even if concerned customers were to disable the Wi-Fi features on their appliances, the appliances would not work as well.

During the panel discussion, Eric Tamarkin, senior public policy counsel at Samsung, expressed hesitance to Feld’s concerns.

He stated that because connected devices using IoT were such a lifeblood for Americans during the height of the coronavirus pandemic, they are and should continue to be used as essential tools for all sorts of day-to-day activities.

Many panelists felt it was important to acknowledge Tamarkin’s point that IoT technology is beneficial, but also stated that IoT system security should continue to be viewed as a work in progress. Katerina Megas, program manager for cybersecurity at the National Institute for Standards and Technology, specifically highlighted the benefits IoT has had for the U.S. economy.

Several panelists also felt that security risks involved with IoT use are compounded by risks of artificial intelligence, creating significant cause for concern with regards to employing IoT technology. They emphasized that cooperation between industry and government is essential to combat concerns over use of this technology.

Continue Reading

Cybersecurity

Congressional Witnesses Say Lack of Agency Resources is Holding Back Government Cybersecurity Efforts

House Freedom Caucus Rep. Scott Perry calls GOP supporters of the bipartisan infrastructure measure “socialist-voting members.”

Published

on

Photo of House committee Chairman Peter DeFazio from May 2014 by Theresa Hogue used with permission

WASHINGTON, December 3, 2021 – Representatives of federal agencies tasked with overseeing the nation’s infrastructure systems told the House Transportation and Infrastructure Committee that their efforts to safeguard national cybersecurity are hampered by a lack of funding for their agencies.

The committee called on testimony from the Transportation Department, the Federal Aviation Administration, the Transportation Security Administration, the U.S. Coast Guard and the Government Accountability Office in the second part of a two-hearing series on infrastructure cybersecurity following a year that saw the number of high profile cyberattacks increase.

The TSA has recently proposed cybersecurity mandates for the transportation industry, only to face significant blow back from key leaders in transportation.

Throughout the hearing Thursday as lawmakers presented agency representatives with proposals to improve federal cybersecurity efforts, the agency representatives frequently cited a lack of resources as preventing them from executing such changes in cyber policy.

Lawmakers find uncertainty for success of proposals

Lawmakers’ questions touched on a wide variety of infrastructure issues.

Rep. Rick Larsen, D-Wash., raised concerns over the usage of C-band interfering with aircraft. The topic has been in the spotlight as C-band use increases with 5G rollout, and the aviation industry has continually requested delays in 5G deployment despite telecom companies already having set back their release dates.

The FAA’s representative at the hearing, chief information security officer Larry Grossman, stated that the FAA believes C-band can safely coexist with aviation, and that further information on the matter was being gathered by both the FCC and the FAA.

Rep. Grace Napolitano, D-Calif., stated examples of breaches in the nation’s water supply systems and recommended virtual cybersecurity training for the employees who oversee those systems.

Rep. Hank Johnson, D-Ga., emphasized that cybersecurity challenges had held up disbursement of emergency government COVID-19 stimulus, creating delays that he said many Americans could not afford. He pointed to the slow pace of cybersecurity solution implementation as a major contributor to these delays.

In one of the day’s more politicized lines of questioning, chairman of the House Freedom Caucus Rep. Scott Perry, R-Pa., asked what was being done to counter what he considered cybersecurity threats specific to electric buses such as lighting fires. In his questioning, he condemned the Republicans who voted for the Infrastructure Investment and Jobs Act, which contains an electric vehicles provision, as “some socialist-voting members.”

Photo of the hearing

The GAO’s representative, director of information technology and cybersecurity Nick Marinos, responded that whether they are gas or electric powered, vehicles are seeing increased potential for hacks.

Like Rep. Napolitano, committee chairman Rep. Peter DeFazio, who recently announced this would be his last term in Congress, said cybersecurity training should be mandated for companies overseeing infrastructure. He emphasized that just before it was hacked, Colonial Pipeline turned down an audit that was offered to it, and that should the audit have taken place the hack may have been prevented.

Additional legislation concerning these hacks has been pushed recently in the House, such as a mandate for quick reporting to the government when companies are hacked.

Continue Reading

Recent

Signup for Broadband Breakfast

Get twice-weekly Breakfast Media news alerts.
* = required field

Trending