[AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
summary
Proposal claims a CyberUL will raise IoT security by requiring publish a software bill of materials, no known CVEs without mitigation, and must be patchable, and by running static analysis dynamic analysis fuzzing and pen tests (currently using just one static tool in early pilots). Concerns: certification cost, transparency, scalability, and false security. Surprising measurements: only 47% of vulnerable Java components ever get fixed and mean time to fix is ~391 days. Standards work is underway but practical coverage and ongoing validation remain unresolved.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 1:08Anita Damico
- 2:57Kevin Green
- 9:12The benefits
- 11:55Risks
- 15:49Cybersecurity standards
- 16:48Certification criteria
- 18:58Lack of innovation
- 23:07Safety by Design
- 27:08Open Source Community
- 27:31Who pays for this
- 29:05How can we help
- 31:06Who is liable for software
- 31:31How can you assign liability
- 32:51Can I retreat the questionable
- 35:36Realistic approaches
- 36:33What can we do
- 37:01Binary Zand
- 39:21Oracle
- 39:40DRM
- 40:05Is there anything else after me
- 42:07Which is the least ugly
- 44:10Insurance
- 47:36Safety
- 48:24Security
- 50:42Architecture
- 53:01Statistics
- 54:19Thank you
related talks
48mCXO PANEL: Security Certifications for IoT Devices
27mIoT: What will security standards and certification look like ten years from now?
41mUnique Challenges Of Security Programs For Hardware/IoT Makers
24mThe CRA Challenge: Can Open Source and IoT Stay Agile Under Regulation?
27mEnterprise IoT Security Compliance: Navigating the Cyber Resilience Act
22mSecuring IoT for Life: Navigating the Challenge of Constant Change
48mSecuring The Internet Of Things
59m(In)secure Things