►
From YouTube: Keynote: Security & Privacy in the Internet of Things
Description
8 October 2018 - Jeff Wilbur delivers a keynote at the Internet Society's New York Chapter event called "How to Make Trustworthy IoT".
Data security and privacy must not be an afterthought. Organizations should take steps to protect all consumer data permanently, because every breach erodes trust. Organizations are entrusted with valuable information with the expectation that those in charge will take the necessary actions to earn that trust. This is responsible data stewardship.
The Internet Society’s Online Trust Alliance (OTA) identifies and promotes security and privacy best practices that build consumer confidence in the Internet. Leading public and private organizations, vendors, researchers, and policymakers contribute to and follow OTA’s guidance to help make online transactions safer and better protect users’ data. The Internet Society is a global nonprofit dedicated to ensuring an open, globally connected, trustworthy, and secure Internet for everyone.
A
A
Learning
a
lot
with
every
question
and
answer
and
I'm
gonna
cover
a
lot
of
similar
themes,
but
maybe
give
a
little
different
or
broader
perspective
on
things,
so
hopefully
it'll
it'll
line
up
here.
So
we're
talking
about
IOT.
How
many
of
you
see
this
as
an
opportunity
most?
How
many
of
you
see
it
as
a
threat
about
an
equal
number?
A
I
asked
that
question
to
a
group
of
Canadian
ISPs
and
the
threat
side
of
the
house
was
much
bigger
because
they're
very
concerned
about
billions
of
devices
attacking
the
network
itself,
as
we
saw
a
couple
of
years
ago
this
month.
So
just
out
of
curiosity
in
the
room
here
who
is
involved
in
offering
IOT
products
or
services
directly
a
good
number
of
you.
Okay,.
B
A
Many
of
you
have
an
IOT,
a
smart
device
in
your
home.
Almost
everybody,
ok,
so
I
think
we
can
all
relate
to
this
very
much.
If
nothing
else
is
consumers,
so
it
is
a
huge
opportunity.
Burt
talked
about
some
numbers,
the
one
we
kind
of
picked
here
was
35
billion
devices
by
2022
they're,
all
they
all
vary,
but
they're
all
big.
So
we
know
that
it's
happening
and
it's
happening
in
a
big
way
and
there
is
opportunity
in
a
variety
of
places.
A
For
most
of
this
talk,
I'm
going
to
focus
more
on
the
consumer
aspect
and
what
consumer
manufacturers
should
do
about
security
and
privacy
and
IOT.
But
this
slide
is
particularly
enterprise
projects,
1,600
Enterprise
projects
and
it
kind
of
breaks
them
down
by
type
just
to
give
you
a
sense
of
where
those
projects
are
happening.
So
smart
city
was
number
one
connected
industry
and
connected
buildings,
two
and
three,
and
so
on
down
the
line.
A
But
it's
happening
very
broadly
and
in
a
lot
of
different
segments
and
depending
on
where
you
are
in
the
world,
the
order
of
these
segments
will
flip
like
if
you
look
in
Africa,
it's
very
much
smart
agriculture
and
some
of
those
kind
of
things
that
are
fundamental
to
society,
as
opposed
to
maybe
consumer
IOT,
which
we
tend
to
think
of
here
in
the
US.
This
is
a
snapshot
from
middle
of
last
year
of
smart
home
market.
You
can
see
some
of
the
growth
happening,
the
top
countries
the
u.s.
A
is
leading
in
this
area
and
the
top
products
there
on
the
lower
right
are
gateways
and
speakers,
security
systems
and
so
forth,
and
this
there's
a
lot
of
data
on
this,
mostly
trending,
in
the
same
direction.
Although
the
details
vary
but
there,
so
there
is
huge
opportunity
to
increase
efficiency
and
convenience
and
all
sorts
of
things.
There
are
a
lot
of
good
business
reasons
if
it's
a
business
application.
There
are
a
lot
of
good
reasons
for
consumers
to
be
using
IOT.
The
problem
is,
and
the
panel
kind
of
brought
this
to
the
surface.
A
A
What's
underneath
and
we'll
get
to
the
fact
that,
even
if
you
want
to
know
what's
underneath
it's
hard
to
find
what
you
guys
pointed
out
in
the
panel,
so
we
need
to
consider
when
we're
looking
at
the
threats
that
are
introduced
by
IOT
devices,
both
internal
and
external,
and
by
that
I
mean
internal-
would
be,
if
you
think,
of
consumer
in
your
own
home.
What
are
the
threats
to
you
in
your
environment?
A
External
is
how
could
those
same
devices
be
used
to
attack
the
internet
itself
or
a
portion
of
the
Internet,
as
we
saw
with
the
Mirai
botnet
two
years
ago,
and
we've
seen
in
in
other
cases
as
well
threats
do
make
headlines.
This
is
a
these
are
several
of
them
from
roughly
October
last
year,
through
April
of
this
year,
I
was
on
a
panel
at
the
RSA
conference
where
we
talked
about
these
topics,
and
these
were
sort
of
a
sample
of
headlines
that
I
use.
A
Then
I
spoke
at
another
conference
in
June
and
just
in
that
few
month
window,
there
were
quite
a
few
more
one
of
my
favorite
that
was
on
that
previous
slide
was
the
hacker
who
it
was.
They
called
it
brick
or
bot.
He
was
so
upset
at
the
fact
that
devices
could
be
easily
hacked
that
he
would
hack
the
devices
and
brick
them
which,
if
you
haven't
heard
that
term
it
means
you
just
make
them
unusable,
and
so
that
was
his
way
of
just
taking
them
out
of
the
game.
A
So
why
that
hacker?
Maybe
the
people
on
those
devices
didn't
think
so,
I'm
sure,
but
anyway,
so
the
there
are
a
lot
of
headlines.
This
cute
little
dog
was
as
a
baby
monitor
that
was
tracking
a
mother
around
the
room
as
she
was
nursing
her
child.
She
asked
her
husband
is
that
you
know
so
yeah
anyway
and
then
just
in
the
last
couple
weeks.
In
fact,
one
of
these
is
today
who's
watching
your
TV.
Suddenly
Sony
quietly
killed
three
critical
bugs
and
their
Smart
TV.
That
was
from
this
morning.
A
So
there's
there's
always
something
going
on,
and
it's
not
really
the
fact
that
there
are
vulnerabilities
in
IOT
it's
that
the
systems
need
to
be
able
to
be
updated
and
quickly
patched
to
address
those
I
know
if
you're
like
me,
with
my
smartphone
I,
get
up
some
mornings
and
43
of
my
applications
have
been
updated
and
a
lot
of
those
are
security
patches.
You
know,
but
it
just
kind
of
happens
silently
under
the
covers.
A
That's
the
way
IOT
should
work,
but
it
doesn't
always
work
that
way,
because
the
manufacturers
aren't
building
in
the
mechanisms
and
the
Headroom
to
allow
that
kind
of
thing
to
happen.
They're
using
hard
coded
passwords
that
anybody
on
the
Internet
can
find
out
what
they
are
and
go
attack
that
device
they're
not
leaving
enough
room
to
do
proper
software
firmware
upgrades
all
that
kind
of
thing.
So
there's
a
there's
a
lot
of
danger.
The
lower-right
one
here
is
Bruce
Schneier,
a
famous
security
researcher.
A
So
here's
another
way
to
think
about
all
this.
This
is
kind
of
the
risk
spectrum,
mostly
for
the
internal,
but
it
could
be
applied
externally.
You've
got
everything
from
on
the
left.
Annoying
that
might
be
somebody's
messing
with
the
volume
on
your
TV
and
or
they're
changing
the
channel
of
music
that
you're
listening
to
annoying
creepy
they're
a
lot
watching
you
they're
listening
to
you,
you
don't
know
what
they're
gonna
do
with
it,
but
super
creepy,
probably
illegal.
A
Then
you
have
digital
theft,
so
they're
breaking
into
your
homes
network
and
getting
onto
your
laptops
or
your
smartphone
and
stealing,
information
that
identity
theft,
kind
of
stuff
and
then
you've
got,
and
this
is
where
IOT
introduces
and
the
panelists
talked
about
it.
Physical
hazards,
unlocking
doors,
opening
garage
doors,
bringing
down
the
electrical
grid,
as
I
just
said,
messing
with
thermostats
in
either
the
hot
or
cold
part
of
the
year.
There's
all
sorts
of
ways
that
this
can
really
have
a
huge
impact
on
the
physical
safety
of
people.
A
So
these
all
need
to
be
taken
into
consideration.
Why
is
IOT
such
a
challenge?
Why
is
it
different?
The
panel
addressed
this
somewhat,
but
just
to
kind
of
look
at
it
from
the
three
major
groups
involved
for
the
manufacturers.
A
lot
of
it
has
to
do
with
the
form
factor.
There's
a
cost
and
size
combination
that
they're
trying
to
achieve
with
these
devices
that
doesn't
leave
much
room
for
battery
power
for
headroom
and
memory
and
processing
or
encryption
and
the
kind
of
things
you
would
want
to
do.
A
There's
all
sorts
of
new
uses
happening
with
all
these
devices
that
they've
never
contemplated
before
bandwidth
different
types
of
use.
The
volume
is
orders
of
magnitude
above
what
they're
used
to.
So
that's
a
challenge
as
well.
They're
dealing
with
naive
players
here
refers
to
the
manufacturers,
not
the
services
people.
So
it's.
What
are
the
manufacturers
doing
to
to
properly
address
security
and
privacy
and
then
a
lot
of
times?
A
They
don't
have
much
insight
into
what's
going
on
inside
that
traffic
wire
did
a
great
article
earlier
this
year
about
a
home
in
San
Francisco,
where
they
put
a
handful
of
smart
devices
in
the
home,
and
then
they
did
a
traffic
monitor
to
see
what
was
going
on
and
those
things
are
very
chatty,
they're
always
phoning
home
and
it's
hard
to
know
are
they
looking
for
software
updates?
Are
they
sending
data
which
may
be
they
may
should
or
shouldn't
be
doing,
even
when
the
home
wins?
A
No
one
is
in
home
and
none
of
the
services
were
theoretically
being
used.
There
was
a
lot
of
traffic
going
on,
and
so
that's
that's
a
huge
consideration
as
well,
and
then
there's
the
consumers
there.
For
the
most
part,
flying
blind,
as
it
says,
they're
on
the
bottom
they're
trying
to
do
it
themselves,
like
they've
done
with
most
other
things
they
bring
into
their
home.
They
really
don't
ice
is
naive
users.
A
They
may
try
to
figure
out
security
and
privacy,
but
it's
almost
impossible
to
figure
it
out
ahead
of
time
unless
you're,
an
attorney
and
I
think
Ken
said.
Even
if
you
are
an
attorney,
you
might
not
be
a
figure
or
Burt
said
that
and
so
that
that
information
is
not
bubbled
up
to
the
top
very
well
for
anybody.
A
You
know
in
vil
way,
if
you
try
to
figure
out
what
are
the
security
issues
associated
with
any
given
device
you're
pretty
much
gonna
have
to
do
an
internet
search
for
that
device
and
the
world
vulnerability
or
hack,
or
something
to
figure
out.
If
there's
a
problem
there,
otherwise
you're,
probably
not
gonna,
know
until
you
have
it
now.
There
are
things
you
can
do
after
the
fact
tail
protect
yourselves,
regardless
of
what
you've
bought.
But
it's
very
difficult
upfront
I'll
talk
more
about
that
in
a
minute.
A
A
C
A
To
have
any
vulnerabilities,
but
you
certainly
don't
want
to
have
those
in
the
upper
right
and
you
want
to
restrict
them
as
much
as
you
can
to
ones
that
might
happen
in
the
lower-left
I
mean,
if
somebody's
outside
your
home,
they
could
also
break
a
window.
Right,
doesn't
mean
it's
okay
to
let
them
hack
your
Wi-Fi,
but
there
are
trade-offs
there
in
terms
of
risk,
and
then
we
have
privacy,
I,
think
that
was
pretty
well
covered
in
the
in
the
panel,
but
it
all
comes
down
to
what
data
you're
collecting.
A
What
are
you
gonna
do
with
it
who
you're
gonna
share
it
with
whether
or
not
I
accept
the
privacy
policy?
Is
that
going
to
affect
my
functionality
like
if
I
get
down
the
the
lines
of
text
on
my
smart
tv,
privacy
policy
and
I
say:
oh
no
I
don't
want
to
accept
this
privacy
policy.
Can
I
still
watch
TV
or
do
I
lose
some
of
the
smart
features?
I
don't
know,
and
then
choice
in
control
and
that's
gdpr
has
a
lot
about
choice
and
control.
A
So
what
are
some
common
mistakes
that
we've
seen
and
we
started
getting
into
this
about
three
and
a
half
years
ago,
looking
at
the
different
principles
that
should
be
involved
in
IOT,
one
of
the
biggest
one
is
default
or
hard-coded
passwords.
So
if
every
device
has
the
same
password,
that's
one
thing:
if
they're
hard-coded,
that's
horrible
at
least
default
ones
can
be
changed.
Although
they're
easily,
you
know,
there's
I,
think
there's
a
website.
That's
this
sixty
passwords
that
cause
them
RI
botnet,
you
know.
So
it's
pretty
easy
to
find
these
default
passwords
out
there.
A
Another
big
problem.
If
devices
are
not
updatable
at
all
and
it's
usually
because
they
don't
have
the
Headroom
to
do
that.
As
bert
said,
I
think
one
of
the
things
that
should
happen
is
you
should
be
supporting
software
updates
for
some
period
of
time.
That's
stated:
no
encryption
is
a
big
issue,
because
a
lot
of
the
hacks
that
you
see
or
because
things
are
sent
in
plaintext
a
lot.
A
A
lot
of
these
things
are
thrown
together
as
kind
of
puzzle
pieces
put
together
into
a
product
and
put
out
in
the
market
and
a
lot
of
times
the
software
stacks
that
are
used
or
ones
that
have
vulnerabilities
that
have
been
known
for
years,
and
yet
they
aren't
tested
in
the
context
of
that
product
and
they're
put
out
in
the
market
and
therefore
highly
vulnerable
from
day.
One
not
looking.
B
A
You
know
social
network
type
services
that
had
cropped
up
I,
don't
see
that
happening
as
much
now
they're
much
more
focused
on
what
is
our
business
model
and
it's
not
figuring
out
how
to
use
the
data
later.
But
that's
an
important
thing,
especially
as
related
to
all
these
new
privacy
laws
that
are
coming
into
play
and
doing
the
right
thing
regarding
privacy
and
then
the
last
one
is
lack
of
a
life
cycle
view
so
in
some
realms
consumer
electronic
kind
of
have
these.
This
throwaway
mentality,
I'm
gonna,
throw
it
away
after
a
couple
years.
A
I'm
gonna
upgrade
it
in
a
couple
years,
like
my
tablets
and
laptops
and
smart
phones.
These
are
not
the
kind
of
devices
you
just
pull
out
after
a
couple
of
years
and
replace
them,
if
you
think
of
traditionally
at
least
thermostats
and
locks
and
refrigerators
and
garage
door,
openers
and
all
those
kind
of
things
those
have
long
life
cycles
decades
in
many
cases.
So
what
are
you
gonna
do
when
you
can't
do
the
security
patches
for
the
refrigerator
anymore?
A
Is
it
do
you
shut
down
the
internet
connectivity
and
now
it's
just
a
refrigerator,
not
a
smart
refrigerator.
Do.
Is
there
a
module,
you
can
upgrade
I
mean
there's
all
sorts
of
ways
to
approach
it,
but
it
needs
to
be
taken
into
account
from
the
beginning
if
you're
gonna,
if
you're
gonna,
do
the
right
thing
as
a
manufacturer,
another
very
similar
one
is
reprovision
ease
things
so
think
of
a
smart
home.
Most
of
you
said
you
had
some
smart
thing
in
your
house.
You're
gonna
sell
your
house.
A
You've
got
a
dozen
different
devices
that
go
with
the
house,
how
you
gonna
hand
off
those
accounts
and
wipe
your
data,
so
people
might
have
access
to
your
history.
I've
heard
so
many
people
say:
I
still
get
the
smart
thermostat
reports
every
month
and
I
still
can
go
in
and
mess
with
the
the
temperature
if
I
want
to
and
they
haven't
had
the
house
for
a
year.
That's
not
good,
and
so
you
got
to
take
all
that
kind
of
stuff
into
account.
So
you
need
to
have
that
life
cycle
view.
A
How
does
this
play
into
what
consumers
are
thinking?
This
is
a
survey
done
by
parks,
associates
who's
focused
for
a
long
time
on
smart
home
and
third
and
fourth
on
this
or
I
guess.
Fourth
and
fifth
on
this
list,
our
most
essential
characteristics
are
that
the
products
are
secured
in
private,
so
it
tends
to
score
pretty
high
there
and
then
what
do
you
care
about
in
terms
of
actually
making
purchase
decisions?
Number
three
is
privacy
and
security.
A
A
So
how
can
we
address
this
issue?
Well,
anything
that
addresses
it.
We
believe,
should
look
at
two
major
dimensions
and
look
at
them
holistically.
So
the
first
is
that
to
look
at
the
entire
system,
so
in
in
our
definition,
that's
made
up
of
the
devices
and
sensors
themselves,
the
apps
that
control
it
and
the
cloud
services
that
back
it
up
often
security
and
privacy
are
talked
about
only
in
the
context
of
the
devices
and
sensors.
A
But
if
you
have
an
app
that
is
vulnerable,
your
just
your
whole
system
is
just
as
vulnerable
as
if
it
was
in
the
devices.
Likewise
with
the
cloud.
An
example
of
this
is
I
think
it
was
earlier.
This
year
might
have
been
late.
Last
year,
LG
had
a
vulnerability
in
their
mobile
app
that
controlled
their
appliances.
You
could
hack
it
get
control
of
all
the
appliances
which
included
a
robot
vacuum
cleaner
that
had
a
camera
on
it.
You
could
just
drive
it
around
the
house
and
see
everything
that
was
in
the
house.
A
It
also
included
their
washing
machines
and
refrigerators.
They
patched
it
very
quickly.
In
fact,
a
lot
of
these
things
you
hear
about
actually
get
patched
before
you
hear
about
him
responsible
vulnerability.
Disclosures
are
such
that
security
researchers
find
the
problem.
They
notify
the
manufacturer
by
the
time.
Most
of
us
hear
about
it.
It's
already
addressed,
but
it
goes
to
the
point
of
it
needs
to
be
updated.
A
You
need
to
have
good
vulnerability
reporting
as
a
manufacturer,
so
you
can
hear
about
that
stuff
and
as
a
consumer,
you
need
to
make
sure
you're
using
the
latest
software
and
firmware
like
that
Sony
story
from
today.
Evidently
they
patched
it
it
late,
August,
early,
September
and
part
of
this
story
coming
out
is
to
make
sure
people
are
informed
to
make
sure
they're
on
the
latest
software
update
for
the
TVs.
Yes,.
A
A
It
is
okay,
I'm
going
to
go
back
for
a
second,
so
you
also
need
to
a
drain
address
the
full
range
of
consumer
concerns
which
already
kind
of
talked
about,
so
not
just
security,
which
a
lot
of
people
just
thinking
in
that
mindset,
not
just
privacy,
but
also
this
extension.
This
lifecycle
aspect,
which
most
frameworks
really
don't
cover
they
might
cover
little
bits
and
pieces
of
it,
but
the
the
mindset
really
isn't
there.
So,
over
the
past
three
and
a
half
years
we've
developed
a
framework,
it
was
first
released
in
early
2016.
A
It's
gone
through
a
few
revisions
now
has
40
principles
of
what
should
be
addressed
by
manufacturers
in
their
offerings,
and
this
does
cover
the
devices
the
apps
and
the
backend
services.
It
can
kind
of
go
into
these
eight
buckets
I'll
just
pick
and
choose
a
few
examples
from
each
bucket,
so
encryption,
encrypting
data
in
transit
and
at
rest
fairly,
straightforward,
but
rarely
done
by
these
products
updates.
You
should
be
able
to
update
them
securely,
as
we
talked
about
just
now:
security,
vulnerability,
testing
and
penetration
testing
before
you
ship
the
product.
A
Some
of
these
are
very,
very
common
sense.
Most
manufacturers-
we've
talked
to
about
this
over
the
last
couple
years,
say:
yeah,
of
course.
Why
would
I?
Why
would
I
not
do
that
and
we
say
well,
why
aren't
you
doing
it
natural
follow-on
question
and
it's
really
a
matter
of
kind
of
product
life
cycle?
They
know
they
should
do
it.
They'll
get
there
over
the
next
product
life,
several
product
life
cycles,
and
so
there
they're
starting
to
move
in
that
direction.
A
Some
of
these
are
actually
some
of
the
privacy
recommendations
and
the
disclosures
and
some
of
this,
the
communications
is:
how
do
you
communicate
with
your
users
securely,
because
there
have
actually
been
cases
where
users
have
gotten
fish,
where
someone
pretends
to
be
the
IOT
manufacturer,
they
say:
I
have
a
software
update
for
your
security
camera,
they
click
on
a
link
and
then
they
download
malware
into
their
security
camera.
And
now
their
network
is
vulnerable,
so
I
mean
it.
A
You
have
to
really
look
at
all
angles
of
this
thing,
so
it's
important
to
look
at
the
whole
thing.
As
I
said,
as
I
mentioned,
we
really
focused
on
the
consumer
segment
with
these
recommendations,
not
that
they
don't
apply
to
other
areas.
The
reason
we
did
that
is
that
in
almost
every
other
area,
industrial
use,
smart
cities,
smart
cars,
medical
devices,
there's
somebody
that
has
oversight
over
that
process.
So
it's
a
network
administrator
in
the
case
of
an
industrial
environment
or
a
smart
city,
its
regulators,
mostly
in
the
case
of
smart
cars
or
medical
devices.
A
But
obviously
there
are,
you
know,
overlaps
here
and
there,
and
these
do
apply
during
the
during
the
process
of
developing
this
framework,
we
had
over
a
hundred
different
stakeholders
involved
in
the
process,
so
we
had
everything
from
industry
to
academia,
to
retailers
of
IOT
products
industry.
A
lot
of
you
know
supply
chain,
as
well
as
in
device
manufacturers,
and
then
lots
of
Internet
privacy
attorneys
representing
consumers,
and
so
we
really
tried
to
find
the
right
balance
in
this.
That
would
be
practical,
but
not
onerous
and
restrict
innovation
for
companies.
A
We
also
developed
this,
and
this
is
one
thing:
I
wanted
to
talk
about
real
quick
with
kind
of
in
mind
that
it
could
be
used
as
a
foundation
for
a
certification
or
Trustmark
program
and,
in
our
mind,
that's
an
important
step
at
some
point
for
the
IOT
industry,
where
that
security
and
privacy
information
can
be
bubbled
up
to
the
surface
in
a
simple
to
digest
way
like
a
mark
or
a
rating.
So
a
consumer
can
know
somebody's
looked
at
that
and
it's
good
now,
given
the
fact
that
these
are
mostly
software
based
products.
A
So
we
call
our
campaign
if
you
want
to
think
of
it,
that
way
of
advocating
for
better
security
and
privacy
and
IOT
trust
by
design
we
sort
of
roll
security
and
privacy
together
into
trust,
and
there
are
sort
of
three
audiences
that
we
would
like
to
reach
through
this
and
ask
them
to
do
something
about
it.
So
the
first
is
manufacturers
and
distribution
chain
retailers.
A
Service
providers,
like
you
know,
comcast,
is
selling
smart
home
bundles
into
homes,
for
instance,
to
actually
look
at
this
trust
framework
and
commit
publicly
commit
to
comply
with
it
at
a
certain
level,
not
that
they've
done
everything
already
I
already
mentioned
the
answer
we
get
on
that
one,
but
those
are
committing
to
a
high
percentage
of
them
and
they
will
fulfill
the
remainder
of
them
over
some
period
of
time.
The
second
is
consumers,
and
mostly
that
has
to
do
with
education.
A
A
We
talked
to
them
about
curating
their
offerings,
so
they're
only
offering
products
that
kind
of
clear
this
bar
and
they
don't
have
a
mix,
creating
a
vulnerability
in
their
offering
for
consumer
organizations.
You
can
come
from
a
lot
of
different
angles,
but
a
lot
of
IOT
product
reviews
really
focus
on
price
and
functionality,
and
they
don't
include
security
and
privacy
and
we'd
like
to
see
that
become
part
of
the
criteria
at
some
level
and
then
grow
help
use
them
to
help
educate
consumers
to
make
smart
choices.
A
So
one
of
the
steps
we've
taken
in
this
area
as
a
partnership
we
announced
a
few
months
ago
with
consumers
international
and
for
those
of
you
don't
know
who
they
are
they're.
Actually
a
membership
organization
made
up
of
all
the
kind
of
consumer
testing
organizations
you've
probably
heard
of
around
the
world,
so
Consumer
Reports
in
the
u.s.
is
the
big
flagship
one
which,
in
the
UK,
is
another
choice
in
Australia
and
they're,
also
tied
into
the
consumer
products
agencies
and
many
of
the
governments
around
the
world.
A
A
There
was
a
lot
of
talk
in
the
panel
about
the
balance
of
regulation
and
self-regulation
for
the
industry.
We
certainly
would
tilt
toward
the
if
we
can
do
it
without
laws.
That
would
be
better,
but
there
may
be
some
requirements
to
do
that
in
some
parts
of
the
world,
but
certainly
policy
makers
can
help
strengthen
the
accountability
of
who's
responsible
for
problems
when
they
occur.
A
This
trust
ability
signals
is
back
to
that
certification
and
trust,
mark
thing,
stakeholders
all
of
them,
involve
service
providers,
manufacturers
and
so
forth
kind
of
incorporate
these
principles,
and
then
they
can
actually
as
a
purchaser
and
there's
a
bill.
That's
been
before
Congress
for
over
a
year
and
hasn't
moved
at
all,
but
as
introduced
last
October
bare
minimum,
the
US
government
would
only
buy
products
that
didn't
have
default.
Hard-Coded
passwords
that
didn't
ship
with
significant
known
vulnerabilities
and
could
be
software
updated.
A
That's
sort
of
I
would
call
it
table
stakes
for
this
kind
of
deal
like
it's
kind
of
brain-dead
obvious,
but
you
know
having
a
small
bar
like
that.
The
the
recent
california
bill
that
passed
that
goes
into
effect,
January
of
2020
I,
think
they
originally
called
it.
The
teddy
bear
and
toasters
law
when
it
first
got
to
introduce
like
early
last
year
and
it
finally
passed
now.
It
says
that
IOT
devices
should
have
reasonable
security.
A
So
policy
makers
are
an
important
thing
and
we
really
see
this
as
a
virtuous
cycle.
So
if
consumers
demand
better
products
and
they
put
pressure
on
policy
makers
and
manufacturers
step
up
especially
leading
manufacturers
and
use
this
as
a
competitive
differentiator,
we
can
kind
of
see
an
upward
spiral
happening
in
IOT.
So
we
have
created
a
lot
of
resources
to
help.
This
is
a
place
that
I
should
should
mention
kind
of
OTA
versus
Internet.
Society
Mitchell
did
a
great
job
of
introducing
kind
of
both
just
for
a
tiny
bit
of
background
information.
A
Ota
was
a
nonprofit
that
started
over
ten
years
ago,
focused
on
kind
of
identifying
and
promoting
security
and
best
security
and
privacy
best
practices
for
enterprises
that
attach
to
the
Internet
and
helping
create
better
consumer
confidence
in
their
online
transactions
as
a
result.
So
where
the
internet
society
traditionally
has
been
focused
more
on
the
infrastructure
of
the
Internet,
so
we
rolled
in
Internet
Society
a
year
and
a
half
ago,
and
we
complement
each
other
very
well.
A
So
this
IOT
work
that
we
had
done
has
now
been
adopted
by
the
entire
organization
around
the
world
and
we're
promoting
it
in
every
region.
We
have
some
other
work
that
we
do
that
we're
doing
that
with
as
well,
but
these
are
some
resources
that
we've
created
and
kind
of
an
or
two
different
brands.
Here
you
might
say,
but
the
principles
or
the
upper
left
there
there's
a
summary
version
of
it.
Then
there's
the
full
list
of
40
with
a
little
bit
of
explanation
about
them.
There's
some
white
papers.
A
Some
of
it
has
to
do
with
by
the
right
things,
but
the
rest
has
to
do
with
what
do
you
do
with
it
once
you've
got
them
and
then
finally,
we
have
an
IOT
security
for
policy
makers.
White
paper.
There
are
some
other
papers
come
in
here
soon
that
will
complement
that
and
we're
gonna
continually
be
adding
to
these
resources
over
time.
A
A
There
are
frameworks
that
are
exclusively
focused
on
security
or
interoperability,
or
whatever
we're
trying
to
look
at
the
ones
that
have
a
broader
level
of
coverage.
So
we
have
ours
there
on
the
left.
Anisa
is
doing
one
that
kind
of
covers
the
whole
EU
you,
the
UK,
did
one
it's
right
in
the
middle
they're
covered
up
a
little
bit
called
secure
by
design.
It
has
13
principles
that
overlap
about
30
of
our
40
are
aligned
with
30
of
our
40.
I
would
say
they
release
that
in
March.
Ask
for
comments.
A
They're
gonna
release
an
update
this
month.
We
understand
so
we'll
see
where
they
landed
there,
but
it
is
focused
on
consumer
IOT
and
they're,
calling
it
a
code
of
conduct
and
saying
to
manufacturers.
You
should
be
doing
this
stuff
and
we're
gonna
watch
you
and
if
you
don't
we're
gonna
put
some
more
teeth
to
this,
so
they
aren't
legislating
it
yet,
but
they're
sort
of
pushing
in
that
direction.
The
upper.
A
Is
from
Australia-
and
we
are
involved
in
that
one
as
well-
the
Internet
of
Things
security
guidelines.
They
incorporated
almost
all
of
our
principles
into
their
document
and
they're
gonna
be
coming
out
with
more
detail
to
this.
So
we're
glad
to
see
this
kind
of
thing
going
on
and
then
NIST
I,
don't
know
how
many
of
you
follow.
Nist,
that's
the
National
Institute
of
Standards
technologies,
I
think,
is
what
it
stands
for.
A
They've
released
three
IOT
things
in
the
last
couple
weeks
and
comments
are
due
in
the
next
month
for
all
of
them
and
they're
the
papers,
but
they're
very
active
in
IOT
privacy.
Security
kind
of
trust
is
an
overriding
umbrella,
so
they're
really
trying
to
give
people
good
guidance
there
in
terms
of
the
testing
and
certification
trust
marks.
Some
of
those
programs
I
already
mentioned,
will
include
like
in
Australia.
A
We
understand
that
they're
going
to
have
sort
of
a
trust
mark
element
that
comes
along
with
that
that's
in
the
works,
but
the
ones
that
are
publicly
known
today.
Ul
has
one
they
call.
Cap
I
think
it's
cybersecurity
assurance
program.
If
I'm
not
mistaken,
the
IOT
security
foundation
based
in
the
UK
has
one
where
there's
a
trust
mark
you
can
submit
and
get
approved.
The
Consumer
Reports
sponsored
something
called
the
digital
standard,
which
they've
done
one
report
on
five
Smart
TVs
that
was
released
earlier
this
year
and
it's
kind
of
an
open
source
criteria.
A
You
can
go
to
their
site
and
give
feedback
if
you
want
and
CTIA
just
a
month
or
so
ago,
released
one
for
devices
that
do
cellular
or
Bluetooth
connections,
which
is
many
of
them,
and
so
they
have
a
certification
plan
that
they've
released
in
the
policy
area,
and
this
is
mainly
legislation.
Although
there's
a
little
bit.
That's
not
so
I,
there's
two
bills
from
a
year
ago,
and
the
US
Congress
I
mentioned
one
already
for
as
a
purchaser.
A
The
other
was
to
establish
committee
to
come
up
with
requirements
for
IOT
devices
and
then
through
a
committee
process,
a
committee
of
experts
process,
so
a
multi-stakeholder
kind
of
process,
and
then
a
plot
and
define
some
kind
of
mark
that
would
be
associated
with
that
it
would
be
a
voluntary
mark.
The
California
law
just
passed
is
on
the
lower
left
there.
The
NTIA
did
a
multi-stakeholder
process
a
year
or
two
ago
on
security,
update,
upgradability
and
patching.
We
were
involved
in
that
so
there's
recommendations
on
what
companies
should
say
to
consumers
about
that.
A
There
have
been
some
reports
to
the
President
and
then
this
one
on
the
right
is
very
interesting,
because
it's
the
first
I
think
and
what
will
be
a
series
of
multi-stakeholder
efforts
in
countries
focused
on
what
to
do
with
IOT.
So
this
one
in
Canada
and
we're
kind
of
the
facilitator
of
it.
I
guess
you
would
say,
kicked
off
in
April
with
about
a
hundred
participants
and
they've
self
formed
into
working
groups
and
the
two
most
active
working
groups
are
user
education
and
labeling
and
I
guess
the
third
one
network
resiliency.
A
A
Education
is
raise
awareness,
and
how
do
we
do
that
best,
but
that
has
involved
a
wide
range
of
stakeholders
and
is
trying
to
find
the
right
balance
between
government
regulation
or
policy
and
Industry
and
everything
else
we're
seeing
similar
efforts
crop
up
now
in
France,
Senegal,
Portugal,
and
so
we're
expecting
that
to
continue
and
that
we
think
it's
a
proper
way
to
do.
It
is
to
get
all
stakeholders
at
the
table
understand
their
needs
and
then
find
the
right
balance.
A
A
There
are
several
standards
underway
that
are
related
to
IOT
and
I'm,
not
going
to
walk
through
all
these,
probably
the
one.
That's
the
furthest
along
and
somewhat
interesting,
related
to
what
we've
just
talked
about
is
the
first
one
mud,
a
great
name,
manufacturer
usage
description.
What
this
is
is
the
manufacturer
can
put
a
description
of
what
their
device
is
and
what
kind
of
communication
you
should
expect
from
hit
on
the
Internet,
and
so
when
someone
sees
a
device
of
that
type.
Let's
say
it's
a
dishwasher
that
should
only
talk
to
certain
places.
A
If
you
see
it
starts
to
beaconing
out
to
everywhere
it's
being
used
as
a
part
of
a
DDoS
attack,
you
can
shut
it
down,
so
this
sort
of
gives
you
a
definition
of
what
is
normal
for
these
kind
of
devices.
So
it's
another
aspect
that
you
can
look
at
to
help
contain
things
which
is
a
great
thing
and
then
there's
a
lot,
a
lot
of
others
as
that
are
related
to
IOT
the
next
IETF
meeting
this.
These
were
all
they
do.
A
A
what's
called
a
rough
guide
to
each
eye,
each
EF
meeting
in
all
these
different
topical
areas,
so
these
are
all
extracted
out
of
the
rough
guide
for
the
one
in
Montreal
a
few
months
ago.
The
next
one
is
in
Bangkok
Thailand
next
month
and
there'll
be
an
update
to
all
these
on.
What's
going
on
so
start
to
wrap
up
here,
IOT
security
and
privacy
is
all
of
our
responsibility
because
we
all
have
a
role
to
play,
whether
we're
a
consumer
manufacturer
policy
maker
and
anything
else
in
between,
and
how
can
you
get
involved?
A
A
If
you
are
a
manufacturer
or
someone
else
who
could
start
to
adopt
these
principles
and
bake
them
into
your
offerings,
we
were
very
much
encourage
you
to
do
that
and
like
you
to
talk
to
you
about
that,
because
we're
initiating
a
program
where
we're
gonna
get
people
to
publicly
commit,
put
their
logos
on
a
website
and
start
to
show
the
world
that
there's
movement
here
and
and
manufacturers
are
stepping
up.
So
if
you're
in
that
audience,
we
would
appreciate
talking
to
you
educate
consumers
on
what
should
go
on.
A
We
had
some
checklists
there
that
are
very
useful
with
that
and
then,
in
far
as
far
as
engaging
with
the
Internet
Society
Greg
gave
you
a
rundown
and
invite
for
the
New
York
chapter,
you
can
be
an
individual
member,
you
can
be
involved
in
any
of
the
chapters,
as
Greg
said,
or
we
do
have
organizational
membership
if
you
want
to
join
as
a
company
and
kind
of
be
inside
the
tent
on
a
lot
of
the
work
that
we're
doing
so.
That's
it.
Thank
you
for
your
attention.
F
Gregg,
thank
you
so
much.
What
we'll
do
is
we'll
we'll
have
some
audience
questions
and
then
we'd
also
like
to
get
into
a
little
bit
of
discussion
after
a
few
questions
to
understand,
be
thinking
about
like
what
are
some
of
the
concerns,
maybe
that
you
haven't
brought
up
already.
What
are
some
of
the
concerns
or
some
of
the
practices
that
you're
either
concerns
that
you
have
about
IOT
security
in
privacy
or
some
of
the
practices
that
you
are
using
in
your
everyday
life
in
your
in
your
company.
F
G
How
about
an
ADA
I
remember
when
I
bought
my
first
PC
8088,
you
have
the
use
of
groups.
Now
you
have
social
networks.
So
is
there
any
point
or
any
issue
with
looking
forward
and
seeing
any
discontinuities,
and
we
have
like
virtual
reality?
As
you
know,
these
smart
devices
create
all
kinds
of
new
ways
of
interaction
and
framework
keeps
up
with
it.
Yeah.
A
A
H
Does
alter
a
suggestion
when
you
talk
about
marking
things
and
for
compliance
and
such
and
you
have
living
documents,
there's
a
big
mismatch.
There
yep
on
revision
levels,
that
people
say
X
compliant
and
the
problem
is
that
takes
compliant
1995,
24/7,
3,
B,
&
C
change,
something
and
it
goes
on
and
on
down
that
rat
hole.
So
if
you're
going
that
route
of
marking
things,
you
need
to
make
sure
the
mark
includes
in
some
way
the
rev
level
of
the
spec,
its
referencing
yeah.
A
Absolutely
it's
going
to
be
mayhem,
yeah,
no
totally
understand
and
I
would
see
that
the
framework
that
I
talked
about
at
a
high
level
would
be
more
of
a
living
document
than
any
specific
certification
program.
I,
don't
think
they
are
a
hundred
percent
linked
at
all
times,
so,
in
other
words,
what
you're
testing
against
may
be
a
little
more
steady
over
time
than
the
framework
evolving.
H
A
H
C
D
So
I'm
gonna
ask
this
question.
Actually,
as
a
consumer
is
I,
don't
want
to
like
put
anyone
on
the
hook
or
anything,
but
are
there
any
men
you
like
companies
that
are
doing
a
really
good
job
of
being
transparent
around
this
kind
of
stuff
that
I
could
look
to
as
a
consumer
and
sidebar
I,
look
I
think
that
a
lot
of
people,
especially
my
generation,
look
to
youtubers,
for
example.
So
have
you
even
seen
one
case
of
a
youtuber
or
someone
or
even
from
a
consumer
education
standpoint?
A
A
Obviously
they
have
to
act
upon
that
they
can't
just
say
it.
But
if
you
look
at
what's
going
on,
some
of
them
have
had
public
vulnerabilities
that
have
happened,
but
they've
patched
them
right
away.
No
different
than
the
operating
systems
we
all
use
and
the
products
we
all
use,
so
it's
not
a
matter
of
did
they
do
something
perfectly
that
never
has
a
problem.
It's
did
they
build
in
the
right
things
to
take
care
of
it
quickly
on
behalf
of
their
cannot
leave
their
customers
exposed,
and
so
there
are
a
lot
of
companies
doing
that.
E
Welling,
so
in
all
of
this
work,
it's
incredible
amount
of
work
and
standards
and
frameworks
and
certifications
and
governments
and
associations
there
any
heretical
whispering
that
maybe
we
have
to
rethink
the
data
paradigm
that
we
have
to
get
away
from
this
permissionless
and
go
more
towards
a
permission
system.
So
the
sender
has
some
of
the
risk
than
just
purely
the
receiver
in
all
of
this
any
sort
of
hint
at
that.
A
Yeah
I
think
there
is
a
lot
of
that
is
being
driven
by
consumer
protection
and
privacy
laws
in
other
parts
of
the
world
which
are
gonna
impact.
You
know
the
question
of
the
panel
in
any
cases.
What
do
you
do
as
a
manufacturer?
Well,
you
kind
of
have
to
go
with
the
I
guess.
I
would
call
it
the
most
highest
common
denominator
like
what's
the
highest
bar.
A
You
have
to
clear
and
if
you
clear
it
everywhere
in
the
world,
then
you're
clearing
it
where
everywhere,
where
it's
lower,
and
so
some
of
the
informed
consent
and
control
over
your
data
is
part
of
those
new
privacy
paradigms,
and
so
we
definitely
see
it
moving
in
that
direction.
The
principles
that
we
have
in
our
framework
aligned
very
closely
with
that
I
should.
E
Have
put
in
a
caveat,
you
know
when
you
look
at
the
call
it
the
informational
stack
and
the
layers
and
as
well
the
edge
and
the
core.
You
know
we
saw
AWS
the
the
news
last
week
that
there
are
pencil
sized
chips
being
inserted
into
servers
and
we're
not
even
protecting
against
those
sorts
of
things
happening.
A
Yeah
and
permission
from
consumers
wouldn't
address
that
that
issue
specific
issue
as
well
I,
know
I
did
hear
some
companies
say
they're,
always
monitoring
data
traffic
out
of
their
devices
and
they
would
know
if
something
anomalous
was
happening.
Don't
know
how
true
that
is.
But
you
know
there
are
ways
to
address
that,
but
that
adds
another
layer
of
complexity.
Cos
you're,
not
gonna,
see
IOT
device
manufacturers
go
to
that
level
because
they
I
mean
that's
a
lot
different
than
a
massive
server
farm
kind
of
application.
A
I
Thanks
so
much
for
the
presentation,
Xavier
shafts
key
question
is,
since
the
speed
of
business,
innovation
and
consumer
demand
are
so
much
faster
than
regulation.
Are
you
seeing
any
data
around
consumers
actually
skewing
more
toward
safer
products
that
are
more
transparent
and
picking
up
on
some
prior
questions
of
you
know,
companies
that
are
actually
talking
about
him,
we're
actually
not
sharing
a
lot
of
that
data
to
consumers.
Are
you
finding
care
about
that
or
is
there
we
just
under
this
new
social
contract,
where
I
just
give
up
my
data.
A
A
To
yeah
and
I
think
I
showed
a
couple
of
the
surveys
there
I
think
generally.
The
survey
of
do
I
care
about
security
and
privacy
is
on
the
up
trend.
Do
I
actually
purchase
based
on
it,
I've
seen
mixed
results.
In
some
cases,
very
low
percent
actually
do
and,
as
I
said
in
the
the
talk,
I
I
really
think
that's
due
to
the
fact
that
it's
hard
to
find
that
information
more
than
more
so
than
people
would
they
care
or
not.
Because
and
it's
where
you
know
theory
meets
reality
right.
A
So
in
theory,
when
you
ask
them
a
survey
question,
if
you
knew
that
these
products
were
had
better
security
and
privacy,
would
you
buy
them,
and
sometimes
the
survey
even
says
even
at
ten
percent
higher
price
just
to
pick
a
number?
And
the
answer
is
often
are
yes,
but
the
behavior
itself
doesn't
show
that
but
whose
judging
whether
it's
better
security
and
privacy
I?
A
That's
the
missing
piece
is
the
awareness
of
what's
out
in
these
products,
so
I
think
once
that
gap
gets
closed,
that
information
gap,
I
think
we'll
start
to
see
more
and
and
I
think
we
are
seeing
more
and
more
consumer
demand
conceptually
for
security
and
privacy,
even
though
it
may
not
be
able
to
be
practically
implemented
by
them.
Quite
yet,
yeah.
B
A
B
A
Actually,
we've
had
just
Believe,
It
or
Not.
We've
had
discussions
with
manufacturers
who
say
encryption,
that's
you
know
that's
a
chip
that
costs
a
quarter
or
whatever
you
know
it's,
it's
not
even
that
expensive,
but
then,
when
you
roll
it
out
through
the
software
that
has
to
go
with
it
and
you
when
you
expand
it
all
on
out
it's
over
the
threshold
that
they're
willing
to
do
from
a
margin
standpoint,
you
know
profit
standpoint
or
whatever
so
I
think
they're
means
to
be
demand
they're
to
have
it
be
a
competitive
differentiator.
A
You
may
very
well
have
that
all
in
your
initial
product
spec
and
you
reach
some
decision
point,
especially
in
the
hardware
where
you
kind
of
cast
it
in
concrete
ish,
and
you
can't
go
back
from
there
and
suddenly
you
didn't
build
in
enough
whatever
to
get
to
where
you
want
to
go
with
all
the
features
you
want.
The
software
part
is
easier.
Some
of
them
are
business
practices,
even
which
that's
a
whole
different
realm.
B
B
A
C
J
Do
mines,
calm,
I
again,
I'm
also
really
excited
about
the
framework
of
creating
I
love.
This
idea
of
trust
by
design
I'm
curious
about
how
you
see
this
framework
being
divergent
if
any
from
things
like
gdpr
and
sort
of
about
the
other
data
or
regulations
come
into
the
forefront
just
quickly.
Skimmed
your
framework
and
I
notice,
things
like
purpose-based
restrictions
and
legal
justification
for
processing
I
didn't
see
that
language
in
there
I'm
just
curious.
What
types
of
things
do
you
think
are
different
from
the
way
that
data
protection
trends
are
going
yeah.
A
So
a
good
question
I
think
we're
not
trying
to
mirror
every
privacy
regulation
out
there.
That
would
be
pretty
onerous,
I
think
what
we
did
was
captured
at
a
sort
of
a
summary
principle
level,
the
core
principles
of
them,
and
we
don't
go
that
next,
half
layer
or
layer
deeper
on
the
specific
language
I
think
you'll
find
I'm
just
trying
to
roll
through
the
list
and
think
if
there
are
any
exceptions,
I
don't
think
there
are
any
exceptions
that
there's
nothing
we
propose
that
would
be
counter
to
what's
in
GDP.
A
A
J
D
Sorry,
when
this
I'm
Heather
Bowden,
when
you
talk
about
just
to
swing
back
to
talking
about
consumers,
I
know
that
when
I
have
done,
searches,
for
example,
in
Bluetooth
I
can't
find
a
flu
tooth
is
even
secured,
like
that's,
not
even
something
I.
Consider
myself
a
pretty
good
Googler
and
I
couldn't
even
find
that
out.
A
So
your
first
point
goes
to
what
I
said
about
it's
very
difficult
to
find
there.
There
are
vulnerability,
reporting
databases,
so
if
you
type
in
a
specific
model
number
of
a
product,
not
Bluetooth
generically,
but
a
model
number
and
then
vulnerability
or
hack,
or
something
like
that,
you
will
find.
Oh,
it's
logged
on
this.
This
database
on
this
site
that
they
had
a
whatever
vulnerability
and
it's
been
fixed
or
not,
and
those
are
that's
public
knowledge
bluetooth
itself.
A
I
mean
there
was
the
blue
Bourne
attack
that
was
revealed
what
a
year
and
a
half
or
a
little
over
a
year
ago,
I
guess
it
was
and
fixed
very
quickly
by
everyone
who
incorporated
Bluetooth,
as
there
was
a
Wi-Fi
vulnerability
that
was
patched
and
that
those
are
scary,
because
those
are
at
the
fundamental
core.
All
our
communication
pretty
much
right
wirelessly,
but
it
is
very
difficult
to
find
and
I'm.
Sorry
again,
I've
lost
the
second
half
of
your
question.
Now
what
was
it?
Your
comment.
D
A
They
don't
really
say
about
yeah
I,
think
they're,
I,
think
people
who
make
that
statement
are
thinking
about
it
in
a
social
network
context
which
they
may
very
well
believe
that
and
practice
that
that's
up
to
them.
But
if
you
say
do
you
care
about
the
privacy
of
your
bank,
account
information
and
transferring
funds
anywhere
you
want
to?
It
suddenly
becomes
a
different
story
right,
because
that
is
eventually
an
attack
that
could
happen
through
an
IOT
device
into
your
laptop
put
some
malware
there
or
keylogger,
and
now
they
have
access
to
your
bank.
Account
I.
A
Think
most
people
care
about
that.
If
you
want
to
use
that
as
an
extreme,
but
it
really
does
go
to
those
attack
vectors
and
the
results
in
that
spectrum
that
I
should,
if
you're
at
the
annoying
level,
so
what
you
start
to
get
into
the
okay,
you
want
somebody,
you
have
nothing
to
hide.
Give
me
access
to
all
the
security
cameras
in
your
house.
24/7
I
think
they
probably
care
they
might
not
know.
A
C
Look,
we
have
an
online
question:
okay
from
habit
heat
bag,
a
he
says,
I
have
learned
about
Big,
Data
and
Hadoop
for
analyzing
big
data
OLAP
with
2.5
quintillion
data
generated
every
day.
How
can
the
security
agencies
and
companies
prevent
an
adversary's
from
sharing
information
and
plans
for
attacks
in
real
time
to
cause
harm
to
organizations,
governments
or
individuals,
especially
with
the
easy
availability
of
tools
in
the
cyber
world
and
the
rise
of
eight
apts?
So
it's
about
you
know.
How
can
you
stop
the
information
getting
out
about
cracks?
I
guess
yeah.
C
A
And
there
there
is
some
of
that
going
on.
If
we
sort
of
know,
if
you
put
in
place,
we
did
an
analysis
back
in
late
2016
of
all
the
publicly
known
reported
IOT
hacks
that
had
happened
in
the
prior
six
months
or
so,
and
we
then
said
what
would
our
principles
do
against
that
list
and
it
would
have
covered
100%
of
them,
which
was
nice
and
it'd
be
nice
if
it
would
always
do
that,
but
you
know
there
are
always
things
that
could
be
outside
those
boundaries,
and
so
but
I
guess.
A
A
Can
somebody
still
hack
in
in
some
way
probably-
and
there
are
there's
a
lot
of
effort
going
on
with
a
lot
of
the
routers
being
offered
by
ISPs
and
in
the
homes
that
sort
of
act
as
and
I
think
this
is
one
of
the
vendors
sort
of
sound
byte
security
blanket
for
your
home,
where
they're
looking
at
the
traffic
like
they
would
for
enterprises
on?
Is
this
proper
traffic
to
be
flowing
in
and
out
of
the
house
and
blocking
stuff
that
doesn't
our
quarantine
in
it
and
so
they're
sort
of
bringing?
A
And
this
is
happening
in
some
of
the
IOT
vendors
as
well
they're
bringing
enterprise
or
some
of
them
even
call
it.
You
know
military
class
security
into
the
IOT
world,
using
the
analysis
tools
that
they
have
in
different
segments
and
applying
it
to
IOT,
which
can
certainly
help
provide
a
much
stronger
ring
of
security.
Around
things
in
general
doesn't
mean
that
you're
you're
immune
ever.
H
H
Similarly,
the
question
of
privacy
depends
on
what
the
definition
of
privacy
is
I
draw
people's
attention
to
how
effectively
the
UK
security
apparatus
was
able
to
track
down
the
GRU
operatives
following
the
poisoning
attack
the
other
week
in
the
UK,
similar
attacks
by
third
parties.
If
the
cameras
are
compromised
for
the
private
cameras
are
compromised
or
a
major
issue,
the
amount
of
information
you
can
back
derive
from
seemingly
innocuous
data
is
spectacular.
Yeah.
H
A
Back
to
your
point
about
TLS,
that
kind
of
goes
to
the
point
I
said
about.
If
you
implement
all
these
recommendations,
and
one
of
them
is
encrypting
data
in
transit
and
at
rest,
if
you
do
that,
analyzing,
the
the
data
itself
is
going
to
be
very
difficult,
depending
on
where
you're
tapping
in
right,
if
you're
tapping
into
the
data
center
on
the
back
end,
you.
F
G
Out
the
event
now,
when
you
mentioned
the
multiplicity
of
standards
and
things
like
that,
you
know
European
right
different
jurisdictions.
Do
contradictions,
that's
a
classification
kind
of
framework.
If
you
have
is
it
possible,
you
could
have
something,
and
that
is
more
numerical
like
when
you
buy
an
air
conditioner.
They
given
an
efficiency
number
or
you
could
have
maybe
like
a
display
on
your
security,
might
be
monitoring
and
you
may
get
feedback
as
a
user
and
saying
something's
weird.
Does
that
at
all
it
is
encompassing
in
your
definition?
There.
A
Are
some
people
who
have
recommended
in
this
Seoul's
kind
of
Trustmark,
labeling
sort
of
realm
that
it?
You
know
they
use
the
energy
star
ratings
as
an
example
I'm,
not
sure
it
applies
as
well.
They've
also
used
the
nutrition
labels.
It's
an
example
of
just
known
ways
of
labeling
that
have
become
common
for
consumers.
I.
Think
more
than
saying
these
are
the
ones
we
should
use.
So
I'm
not
sure
that
applies,
but
it
is
difficult
because
if
you,
if
you
make
it
an
all-or-nothing
mark
or
no
mark,
where
is
the
line?
A
Is
it
it
probably
can't
be?
Super
high,
like
crazy
high,
probably
needs
to
be
somewhere
in
the
middle
and
then
how
you
gonna
enforce
that
it
that
they
maintain
it
most
of
the
folks.
We've
talked
to
a
recommending
that
products
get
recertified
every
year
or
unless
there's
a
major
in
the
UL
world.
It's
when
you
make
a
major
Hardware
change.
You.
B
A
There
are
acceptable
changes
that
don't
require
recertification
in
the
UL
Hardware
electrical
safety
world
in
a
software
based
world,
it's
much
more
difficult
and
you
know
when
I
was
in
Australia
the
one
of
the
major
industrial
manufacturers.
There
said
I
have
a
thousand
IOT
products,
I'm
not
going
to
pay
ten
thousand
dollars
apiece
to
get
him
certified.
So
what
should
I?
Do
they
didn't
say
to
me?
They
said
it's
somebody
else,
but
I
heard
it.
So
that's
a
challenge
because
I've
heard
numbers
like
there
are
a
thousand
new
IOT
products
a
day.
A
I,
don't
know
what
the
number
real
number
is.
It's
a
lot
and
so
expecting
that
they're
all
going
to
get
certified
and
it
is
gonna,
be
a
challenge
in
and
of
itself.
I
think
you'll
see
big
companies.
Do
it
first
and
then
you'll
see
certain
startups
in
certain
niches.
Probably
do
it,
but
if
you
expect
to
see
it
on
every
product,
everybody
delivers.