Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers...

19
Disclosing Vulnerabilities and Breaches in the ‘Internet of Things’ Ross Anderson Cambridge CEPS, Sep 27 2017

Transcript of Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers...

Page 1: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

DisclosingVulnerabilitiesandBreachesinthe‘InternetofThings’

RossAndersonCambridge

CEPS,Sep272017

Page 2: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

WhatwilltheIoT change?

• PrivacymadetheearlyrunningwiththesmartTVandtheCayla doll– butyourphonealreadyhearseverythingandisfullofadware

• Denial-of-servicewasnextwiththeMiraibotnet– butwealreadyhavebotnets

• Butsafetylooksliketherealpressurepoint• Phonesandlaptopsdon’tkillmanypeopledirectly;carsandmedicaldevicesdo…

CEPS,Sep272017

Page 3: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

HowdoesIoT changesafety?

• Eireann Leverett,RichardClaytonandIdidaprojectfortheEuropeanCommission

• TheEUhascomplexregulatoryregimesforthesafetyofallsortsofdevices

• Howwillthesehavetochangeoncethere’ssoftwareeverywhere?

• Welookedspecificallyatvehicles,medicaldevices,andelectrotechnical equipment

• Butthelessonsaremorewidelyapplicable!

CEPS,Sep272017

Page 4: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

EUproblemstatement• Weregulatesafetyinmanyindustries• The“InternetofThings”putscomputersandcommunicationseverywhere

• Thiscreatesnewsafetyrisksaroundsecurity• Indeed,thetwoarethesameinthelanguagesspokenbymostEUcitizens(sicurezza,seguridad,sûreté,Sicherheit,trygghet…)

• Howdoweupdatesafetyregulation(andsafetyregulators)tocope?

CEPS,Sep272017

Page 5: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Background

• Marketsdosafetyinsomeindustries(aviation)waybetterthanothers

• CarsweredreadfuluntilNader’s‘UnsafeatAnySpeed’firedupthepublic,gotinsuranceindustryinvolvementandledtotheNHTSA

• IntheEU,wegottheProductLiabilityDirective85/374/EES,FrameworkDirective2007/43/EContypeapproval,andmuchmuchelse

• Broadprinciples,plusmanydetailedrules

CEPS,Sep272017

Page 6: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Background(2)

• Traditionalcarmakersmovingtoautonomyinsteps(adaptivecruisecontrol,automaticemergencybraking,automaticlanekeeping…)

• TeslahasalreadymovedtoregularupgradesandthelegacyOEMsareracingtofollow

• Butmanagingvulnerabilitiesishard,andexpensive:Androidispatchedfor3years,Windowsfor5

• Sohowwillwepatcha2017carin2037?

CEPS,Sep272017

Page 7: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

CEPS,Sep272017

Page 8: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

CEPS,Sep272017

Page 9: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Background(3)• TheMedicalDeviceDirectives(90/385EEC,93/42/EEC,98/79/EU)arenowbeingrevised

• ResearchbyHaroldThimbleby:intheUK,hospitalsafetyusabilityfailureskillabout2000p.a.(aboutthesameasroadaccidents)

• Priority:getregulatorstodopost-approvalstudiesandadverseeventreporting

• Atpresentdevicesaretypicallyapprovedonpaperworkalone

• Evenlesspost-marketfeedbackthaninpharma…CEPS,Sep272017

Page 10: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Background(4)

• Usabilityfailuresthatkillaretypicallyblamedonthenurse(ifnoticedatall)

• Butattacksaremuchhardertoignore– a2015wifi tamperingdemoledtheFDAtoblacklisttheHospira Symbiq infusionpump

• 2017:recallof450,000StJudepacemakers• Butsoftwareupgradescanbreakcertification!• Propersafety/securitylifecycleisneeded

CEPS,Sep272017

Page 11: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

TheBigChallenge

• Establishednon-ITindustriesusuallyhaveastaticapproach– pre-markettestingwithstandardsthatchangeslowlyifatall

• Thetimeconstantistypicallyadecade• Whenmaliciousadversariescanscalebugsintoattacks,industrieswillneedadynamicapproachwithpatching,asinIT

• Thetimeconstantisthentypicallyamonth

CEPS,Sep272017

Page 12: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Broadquestionsinclude…

• Whowillinvestigateincidents,andtowhomwilltheybereported?

• Howdoweembedresponsibledisclosure?• Howdowebringsafetyengineersandsecurityengineerstogether?

• Willregulatorsallneedsecurityengineers?• Howdowepreventabusivelock-in?NotetheUSDMCAexemptiontorepairtractors…

CEPS,Sep272017

Page 13: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

InstitutionalPlayers• DozensofEuropeanregulators(+hundredsinMemberStates)

• Standardsbodies(UNECE,ETSI,CEN,CENELEC)• Safetylabs(KEMA,EuroNCAP,…)• Securitylabs(CLEFs,Underwriters’Labs,commercialpentesters,ENCS,academics…)

• OthercustodiansofthemanysafetyandsecuritystandardsincludingNIST,IEEE,IEC

• Otherprincipals,e.g.insuranceindustry

CEPS,Sep272017

Page 14: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Policyrecommendationsincluded• Requirevendorstoself-certify,fortheirCEmark,thatproductscanbepatchedifneedbe

• Requireasecuredevelopmentlifecyclewithvulnerabilitymanagement(ISO29174,30111)

• CreateaEuropeanSecurityEngineeringAgencytosupportpolicymakers(now:ENISA)

• ExtendProductLiabilityDirectivetoservices• UpdateNISDirectivetoreportbreachesandvulnerabilitiestosafetyregulatorsandusers

CEPS,Sep272017

Page 15: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Translatingthistoengineering• Theproblemasalwayswillbescale• Europehas50,000fatalaccidentsayearandtentimesthatmanycausingseriousinjury

• Futurecarswillgeneratevastamountsofdata• Howdotherightdatagettotrafficcops,insurers,safetyregulatorsandothers?

• Wecan’tjustreportvulnerabilitiesandbreachestoENISA/SIAs/DPagencies!

• Culturechangetoo(e.g.VWvBirmingham)CEPS,Sep272017

Page 16: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Implicationsforcomputerscience• Computersciencehasalwaysbeenaboutmanagingcomplexity

• Safety-criticaldurablegoods,online,andcomposedofheterogeneouscomponentsfrommutuallymistrustfulsuppliers,arethenewgrandchallenge

• SincedoingthisprojectI’vestartedteachingsafetyandsecuritytogetherinthesamecoursetofirst-yearundergraduates

CEPS,Sep272017

Page 17: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

Conclusions• TheEUregulatessafetyindozensofindustries• Oncesafety-criticalgoodscanbeattackedonline,it’spatchorscrap

• Fordurablegoodslikecarsandmedicaldevices,thiswillbeareallyreallybigdeal

• Tomanagetheecosystem,avastamountofdataonvulnerabilities,breachesandaccidentswillhavetobemanaged

• Manypolicychallengeslieahead!CEPS,Sep272017

Page 18: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

More…

• Ourpaper“Standardisation andCertificationintheInternetofThings”isonmywebpagehttp://www.cl.cam.ac.uk/~rja14/

• Orsee“WhenSafetyandSecurityBecomeOne”onourblog

https://www.lightbluetouchpaper.orgwhichalsohasacoupleofvideos

Cambridge,Sep2017

Page 19: Disclosing Vulnerabilities and Breaches in the …...•The “Internet of Things” puts computers and communications everywhere •This creates new safety risks around security •Indeed,

CEPS,Sep272017


DISCLOSING NATURE'S POTENTIAL

DISCLOSING NATURE'S POTENTIAL

Pro Tips for Defending Your Organization from Data Breaches · To discover data breaches, leakages, and vulnerabilities on the Internet, we use Shodan search engine (and similar)

Pro Tips for Defending Your Organization from Data Breaches · To discover data breaches, leakages, and vulnerabilities on the Internet, we use Shodan search engine (and similar)

Disclosing password hashing policies

Disclosing password hashing policies

An Empirical Study of Vulnerability Rewards Programs...which software vendors use to encourage community participation in finding and responsibly disclosing soft-ware vulnerabilities.

An Empirical Study of Vulnerability Rewards Programs...which software vendors use to encourage community participation in finding and responsibly disclosing soft-ware vulnerabilities.

The Importance of Disclosing Sponsorships

The Importance of Disclosing Sponsorships

INTELLECTUAL PROPERTY Disclosing patents’ secretspages.stern.nyu.edu/~dhegde/GrahamHegdeScience.pdf · These differences suggest that U.S. small ... Disclosing patents’ secrets

INTELLECTUAL PROPERTY Disclosing patents’ secretspages.stern.nyu.edu/~dhegde/GrahamHegdeScience.pdf · These differences suggest that U.S. small ... Disclosing patents’ secrets

Pocket Guidedata.over-blog-kiwi.com/0/86/...disclosing-your-esg... · Pocket Guide: Disclosing your ESG footprint Pocket Guide: Disclosing your ESG footprint SRI, ESG… let's make

Pocket Guidedata.over-blog-kiwi.com/0/86/...disclosing-your-esg... · Pocket Guide: Disclosing your ESG footprint Pocket Guide: Disclosing your ESG footprint SRI, ESG… let's make

Disclosing worlds and embodying knowledge

Disclosing worlds and embodying knowledge

Guidelines for disclosing unanticipated events

Guidelines for disclosing unanticipated events

Cybersecurity: Vulnerabilities, Attacks, and Mitigating ... · • Business wants to – Brand protection prevent incidents/breaches – Ease of technology use – Meet their strategic

Cybersecurity: Vulnerabilities, Attacks, and Mitigating ... · • Business wants to – Brand protection prevent incidents/breaches – Ease of technology use – Meet their strategic

Disclosing New Worlds

Disclosing New Worlds

Application Security as a Service: Start Your Application ... · 5 The Majority of Security Breaches Today are From Application Vulnerabilities Security incidents from exploits against

Application Security as a Service: Start Your Application ... · 5 The Majority of Security Breaches Today are From Application Vulnerabilities Security incidents from exploits against

Disclosing Medical error Nau

Disclosing Medical error Nau

Security Services and AppScan. Why Develop Secure Applications 1.Prevent Vulnerabilities. [account and data theft] 2.Prevent Breaches. [$200/record notifications]

Security Services and AppScan. Why Develop Secure Applications 1.Prevent Vulnerabilities. [account and data theft] 2.Prevent Breaches. [$200/record notifications]

Law Enforcement Using and Disclosing Technology ...Law Enforcement Using and Disclosing Technology Vulnerabilities Congressional Research Service 1 here has been increased discussion

Law Enforcement Using and Disclosing Technology ...Law Enforcement Using and Disclosing Technology Vulnerabilities Congressional Research Service 1 here has been increased discussion

Methodological Approaches to Disclosing Historic Photographsmargolis.faculty.asu.edu/articles/Disclosing_historic_photos.pdf · Methodological Approaches to Disclosing Historic Photographs

Methodological Approaches to Disclosing Historic Photographsmargolis.faculty.asu.edu/articles/Disclosing_historic_photos.pdf · Methodological Approaches to Disclosing Historic Photographs

Finding Network Vulnerabilities. 2 Objectives Define vulnerabilities Name the common categories of vulnerabilities Discuss common system and network vulnerabilities.

Finding Network Vulnerabilities. 2 Objectives Define vulnerabilities Name the common categories of vulnerabilities Discuss common system and network vulnerabilities.

90% of data breaches are caused by software vulnerabilities. · • Identify threats proactively • Create threat trees for your components • Use threat trees to find vulnerabilities

90% of data breaches are caused by software vulnerabilities. · • Identify threats proactively • Create threat trees for your components • Use threat trees to find vulnerabilities

Taking control of risk and vulnerabilities · 2018-02-01 · Taking control of risk and vulnerabilities | Page 1 White paper Data Breaches & Supply Chain: Our new insight Taking control

Taking control of risk and vulnerabilities · 2018-02-01 · Taking control of risk and vulnerabilities | Page 1 White paper Data Breaches & Supply Chain: Our new insight Taking control

Copy of Disclosing Non-Disclosing Markets_GDR HMS

Copy of Disclosing Non-Disclosing Markets_GDR HMS