Don't be too shocked, but it looks as though these politicians have actually got their act together on IoT security

"Politicians" and "got their act together"

Naah. Don't belong in the same sentence.

But then I started noticing politics way back when politicians were soft and cuddly and weren't actually supposed to do anything,

This won't stop the flow of cheap consumer Things

Merely mandating Federal procurement standrds will have minimal influence on the buying power of hundreds of MILLIONs of US consumers who will be offered all kinds of imported Things costing no more than a few dollars apiece.

Originating from beyond US jurisdiction, their manufacturers will not feel obligated to comply with US standards or to offer what might be thought of as appropriate lifetime support services - for example, security patching.

What could possibly go wrong?

Much more work can and should be done to figure out how best to prompt millions of consumers to keep their devices updated or it's just a matter of time before their IoT devices becomes a security issue.

IoT devices already have big security issues, it is not a matter of time.

Just as big a problem is privacy. Why should a temperature controller need to know everything including the name of your maiden aunt.

leaves things to NIST to figure out.

That hasn't worked out to well in the telecommunications sector, just look at Pai's FCC...

Mark Warner has a tech background, even if he is not an engineer. He is no idiot.

I don't know how much consumer IoT the Federal Government purchases, though. I hope not too much, otherwise we are already 0wned by the Chinese and Russians...

Optimistic

I'll be impressed if it actually gets through unscathed, but I'm not holding my breath. Seen too many good ideas derailed by vested interests

"But, as we noted at the time, it was also a wasted opportunity: unique passwords are a big problem but so is software that is not updated and left in the hands of consumers."

Since we're talking the IoT, we have to assume there will be instances where the item CAN'T be upgraded due to poor communication: just enough to pass telemetry but far from sufficient to do a software patch. In which case, the best course would be to go back to the pre-Internet practice of getting it right the first time because there are no second chances. If something like this has a problem, you're better off getting the damn thing replaced whole.

Updates

At the risk of becoming yet another broken record (in the vinyl sense of the word, not the Guinness sense), there are at least two issues around updates:

1) Devices need to be _capable_ of updating their software (and of reverting to a "not great but not totally borked" state).

2) Making updates mandatory, non-reversible, and silent? That's how a zero-day at the manufacturer becomes a worldwide shit-storm.

(And that's not even addressing which criminal gang/government agency is using that zero-day.)

Missed opportunity ... prompt millions of consumers to keep their devices updated...

Shirely this requires manufactures to, oh I don't know, fucking provide updates!

That's the weak link. Right now they ship insecure shit and never provide updates because they can't be arsed, and aren't in any way compelled to do so.

When there is bipartisan agreement

And wow, industry on top, the results are always....

Let's look at history. Bank deregulation - shortly before the big financial disaster. Check.

McCain-Feingold campaign finance "reform" Check.

Quite a few others but I won't bore you. It always seems to mean delegating power to industry. Money is speech and all that.

Sam Clemens had it right. We're safer when they're not in session.

And yes, updates...the first zero day gets you all.

We find an issue of security. So we send an update to the device that has a security issue. Surely there's no way that security issue would allow some miscreant to send that device an update that was...a security issue.

These guys are smarter than that, or one would hope, I know at least a couple of them are. So we're back to my usual cynical "cui bono".

I'll save you typing it into google: https://en.wikipedia.org/wiki/Cui_bono

It's rarely been violated in recorded history.

One part of any proposed rule or legislation should make it HARDER for manufacturers of insecure kit to claim damages from hackers, and EASIER for their customers to claim damages from THEM if they get pwned. Also, include a clause that, should the company go bankrupt, any entityy acquiring their trademarks, IP, assets, good will (if any), etc., are also, knowingly and explicitly, acquiring any liabilities for the insecure products, as well. It would be nice if directors could be held personally liable since, much like "(k)nowing that one is to be hanged in ten days..." knowing that one's own, personal wealth is at risk "... tends to concentrate the mind wonderfully", but that may be a bridge too far.

How does this work at the moment?

All electronics sold in the US is supposed to have pass the FCC tests to meet standards for RF emissions and RF interference rejection - but how much imported kit actually gets tested? You can buy all sorts of things on the Internet that claim to be legal in the USA but have never been tested and have no FCC IDs. Does anyone thing that the new IoT standards will be any different?

US industry should support standards for IoT security

In the auto industry, many vehicles available outside North America don't meet safety standards, so competion for US manufacturers is reduced. At present, consumers have few ways to judge the quality of IoT devices, but they know how much they are paying, so cheaper mostly wins. With credible standards many consumers will pay more for compliant devices. Local governments are heavy users of IoT building management and security cameras. With credible standards, it will be much easier to justify spending more on a better class of devices. For US industry, the standards will be a barrier to cheap imports from vendors who lack the expertise to build standards compliant gear. A big question will be how much influence US law enforcement can exert to have standards mandate back-doors.

Huh? Are you Kidding ?

Politicians don't know shit about IoT or even what it stands for, or much of anything else, IMO. It is the staffs or lobbyists that pump all this stuff into their voting habits. If there is MONEY in getting something fixed, partisan bickering goes out the window. Sure, they'll come together and do something because the 'industry' is funneling money into their greedy little campaign chests, of both parties. And maybe into other places as well. The politicians themselves probably don't even know about it. Just my $0.02 worth. Huh?

IoT is already off the rails

This idea that software is inherently full of vulnerabilities and so has to be patched all the time is really a side effect of a relative handful of consumer operating systems. We, the public, have become accustomed to the notion that fixing bugs is a game of 'Whack a Mole' where every fixed bug causes problems elsewhere, opens more vulnerabilities and so on. This might be good eating for product and software vendors but its not the way that we should be treating devices. We can't secure ordinary computers properly so why would we even contemplate spreading the same sorts of vulnerabilities to what are essentially peripherals?

It is true that there are a lot of existing things that lack proper security but they were for the most part designed for an environment where threats were considered unlikely. Securing them should be straightforward provided we can get away from this concept that everything has to be globally accessible by everything else. Experience with 'things' will tell you that you need to trade information volume for information quality, if you don't then you'll get mired in irrelevant data (and there's no point in assuming that 5G will fix that problem for you -- it didn't when connections were wired so its unlikely to economically do the job wirelessly).

Still, I figure that IoT is primarily a marketing exercise mostly implemented in Powerpoint so I'll just keep on doing what I do and wait for something viable looking to turn up....

Will they have to have back doors as well?

You know, for law enforcement reasons.