Re:Schneier: It's Time to Regulate IoT to Improve Cyber-Secu...
by AnthonyMouse on Thursday November 16, 2017 @09:52AM
(#15713005)
> I'm not sure it could work for IoT, though, because a lot of IoT devices are made by new companies that probably will not be around long. With things like lawn mowers, you could takes years to get around to cutting your hand off, and still reasonably expect the manufacturer to be around. Not so with a lot of IoT devices.
This is the problem.
And "solutions" like that can easily backfire, because they squeeze medium sized companies out of the market, who might stake out a middle ground between $20,000 Cisco hardware and $150 "disposable cameras" from Fly By Night Corp, by charging $200 for a product that actually guarantees patches for a specific number of years.
Because the liability risk raises the price the middle-ground company has to charge to the point that they can't compete with Fly By Night Corp who doesn't care. Which means more sales of insecure garbage products, because the customer no longer has the option to buy an affordable product that receives patches, and that customer can't afford the $20,000 industrial grade product, so more people end up with the insecure garbage.
It would be much more effective to just require manufacturers to provide security patches for e.g. 7 years. Fly By Night Corp still wouldn't do it, but then at least Samsung would.
This is the problem.
And "solutions" like that can easily backfire, because they squeeze medium sized companies out of the market, who might stake out a middle ground between $20,000 Cisco hardware and $150 "disposable cameras" from Fly By Night Corp, by charging $200 for a product that actually guarantees patches for a specific number of years.
Because the liability risk raises the price the middle-ground company has to charge to the point that they can't compete with Fly By Night Corp who doesn't care. Which means more sales of insecure garbage products, because the customer no longer has the option to buy an affordable product that receives patches, and that customer can't afford the $20,000 industrial grade product, so more people end up with the insecure garbage.
It would be much more effective to just require manufacturers to provide security patches for e.g. 7 years. Fly By Night Corp still wouldn't do it, but then at least Samsung would.