DHS Offers Its Unsolicited 'Help' In Securing The Internet Of Things

(Mis)Uses of Technology

from the STANDING-BY-TO-TAKE-CREDIT-FOR-ACTIONS-OF-OTHERS dept

It’s generally agreed that the state of security for the Internet of Things runs from “abysmal” to “compromised during unboxing.” The government — despite no one asking it to — is offering to help out… somehow. DHS Assistant Secretary for Cyber Policy Robert Silvers spoke at the Internet of Things forum, offering up a pile of words that indicates Silvers is pretty cool with the “cyber” part of his title… but not all that strong on the “policy” part.

The industry, according to Silvers, is demanding that IoT security is tackled “from a DHS perspective,” meaning a focus on public safety. And then he damned other government departments’ efforts with faint praise.

“This is complex stuff, but it’s not going to be regulatory or over prescriptive, it’s not even going to be highly technical,” he argued. “What we’re going to be doing is drawing on the best approaches, pulling them together and elevating them to get the public’s attention.”

Shorter DHS: we’re going to take what the private sector and other government agencies have accomplished, print it out on a few pages of DHS letterhead, and call it good. All Silvers is promising is the DHS’s insertion into a crowded marketplace of vague ideas, many of them coming from other government agencies.

Even better, Silvers claimed the DHS’s intrusion into this overcrowded space won’t be “regulatory.” This statement arrived shortly before Silvers suggested regulation was on its way.

“We have a small and closing window of time to take decisive and effective action,” Silvers said, “the challenge of addressing IoT security is outweighed only by the greater challenge of patching, or building on the security of already deployed systems. While some of this may sound like common sense, it’s an undeniable fact that some companies are not being held accountable,” Silvers said.

“Companies not being held accountable” sounds like the sort of thing the government would feel compelled to fix with regulation. As Kieran McCarthy of The Register points out, the DHS seems mostly concerned with ensuring it’s cut in on the cybersecurity action.

The DHS’s current plan seems to be little more than shoving their foot in the door: Silvers could not give a timetable for the principles, or even a consultation plan. He didn’t highlight specific areas of concern, or point to the direction the DHS is expected to take.

Perpetually-increasing budgets are on the line here. Every agency wants a piece of the “cyber” pie, whether on the offensive or defensive side. The DHS is no different, even though its track record on cybersecurity is mostly terrible. (Its track record on “homeland” security isn’t that fantastic either…) Its Election Cybersecurity task force is composed of state politicians, rather than security experts. And the Government Accountability Office has previously noted the DHS has no plans in place to protect government buildings from cyberattacks on access and control points — despite having had nearly 15 years to do so.

In front of a group of professionals actually putting together best practices for the Internet of Things, the DHS has announced its willingness to coattail-ride its way into the cybersecurity future — one promising to be full of government intrusion and steady paychecks. And, like others in the government who feel the government should do nothing more than make demands of the private sector, Silvers encouraged the forum attendees to “nerd harder.” Or, at least, faster.

Silvers issued a call of action to attendees, urging them to “accelerate everything” they’re working on and tackle issues that pop up in cybersecurity in real time.

Thanks, bossman. There’s nothing security professionals like more than being told how to do their jobs by government agencies without coherent future plans or the ability to secure anything more than a pension.

Filed Under: cybersecurity, dhs, iot, security