26.3.21

When repairing things you own may make you an outlaw

 

 How do you balance the right to repair with the requirements to remain secure?

Cameron Camp


Images of jackbooted, militarized cops descending into dimly-lit basements where appliance techs slap grimy, roughshod parts of doubtful lineage together come to mind in the still-simmering fight – yes, it’s a fight – to allow people to work on the tech they already bought and own. You’d think this wouldn’t be a thing: If you buy a device, it’s yours, hopefully you won’t need to repair it or can have it easily repaired and the manufacturer can get on with making more new technology for when you’re ready for their next gizmo or gadget. Not so.

Step away from that screwdriver, back away from the digital gizmo, you may be breaking the law. Want to fix a security issue because the manufacturer won’t? That just might be criminal.

Aside from the pseudo-obvious dark imagery of hardened criminals hastily etching out makeshift tattoos in a somewhat non-sterile fashion in the prisons of the world being joined by a fresh batch of fix-it smartphone techs from our malls, the tech industry, in some parts, is arguing that if you lift a screwdriver or 3D print a replacement gear for the drive on your printer that you risk doing time.

It’s part of a weird dystopian view of what the future might look like, where you really only rent-with-license some new e-doodad and then when it fails you buy new stuff and don’t ask questions.

Well, really, you re-rent the objects you already “bought” via smarmy licensing from the manufacturer. And once they fail, you merely rinse-and-repeat. It’s as if Phillip K. Dick met Wall Street, trying to find the bleakest way to increase shareholder value.

But this fills the world with hordes e-junk in a cycle that shows no promise of slowing. Except the world is fighting back.

Two years ago you bought a dishwasher; now there are no parts to be had for simple, typical appliance repair items like water pumps, drives, or gears. Sometimes they’re glued together so you have to chisel them apart and hope for the best. Open a shop to help others and you’re doomed – watch for the coppers to come lock up your ratchet sets if you step too far into the seedy world of black-market repairs.

But the planet is fighting back; sometimes winning, sometimes not so much.

·       In Norway, a one-man repair shop lost a multi-year legal battle against Apple. His crime? Importing recycled iPhone screens to repair phones, which Apple claimed were “counterfeits.”

·       Farmers are learning how to reverse engineer their own tractors so they can perform repairs in the field, ranging from trading information in private Ukrainian forums to downloading debugging tools from a CalPoly student project.

·       In New York City, independent Apple repairman Louis Rossman has testified before government multiple times about the right to repair.

EU legislators think high-tech goods should have a 10-year service life with widely available parts, tools and perhaps even repair documentation and are spearheading laws to enforce this. Oh, the sacrilege, if you ask some manufacturers; they say the EU shouldn’t meddle.

Pitting repairability against security

While the right to repair seems like a classic black-and-white situation pitting consumers against manufacturers, it is actually a more nuanced discussion, particularly if the device in question is meant to be attached to a network of some kind.

If so, there are several additional issues that come into play: Any device that utilizes a network connection in some fashion is, by definition, going to be exploitable over that connection.

As technology improves, flaws may be found in cryptographic protocols (or in their implementations), digital signatures may expire, and vulnerabilities may be found in operating systems or the applications that run on top of them. It may be possible to engineer a device with enough processing power, storage and other resources to last for ten years’ worth of updates to fix these types of issues, but there is a larger question of whether the device will still work well after a decade of updates and security patches. And that’s ignoring any additional code required to integrate with new standards, which still may cripple performance.

For IoT devices, these problems are manifest. These types of devices are typically manufactured with the bare amount of computing power to get the job done today, and rely heavily on the device manufacturer’s cloud for management. Control of the device may be performed by an app on a smart phone. All of these must not just continue to be maintained, but secured as well. And with all of that comes an increasing drain on processing and storage resources.

For devices powered by them, battery technology becomes an issue as well: Rechargeable batteries have finite charge cycles and as they degrade, so does their ability to store energy. This occurs even when they are sitting on a shelf and not being used. Having to keep manufacturing replacement batteries (and storing them in inventory) for a decade may cause an increase in the amount of electronic waste of these types of devices, which can be more difficult and hazardous to recycle than other types of components.

There’s still hope

So, how do we balance the right to repair with the requirement to remain secure? The answer might not be to just allow for devices to be repaired, but to be modular enough that they can be easily upgraded or have various parts reused. This has been common with desktop and server computers since they were introduced. Memory, expansion cards, storage and even processors could be replaced over time as usage demands and requirements change. This used to be true of laptops as well, although the gimmick of making them thinner every year like smartphones and using glue and other repair-unfriendly assembly methods is cause for concern. There are some hopeful signs, though.

For example, in 2016, Google, which owned Motorola at the time, announced Project Ara, a plan to make modular smartphones that could be upgraded in various ways. No products ever shipped, but Motorola eventually released their Moto Z family, which could be expanded by snapping on various backplates called Moto ModsFairPhone is selling a modular platform, including smartphones you can assemble yourself, and PINE64 has released a smartphone capable of running different versions of Linux. A company called Framework has announced a modular laptop that can be upgraded and repaired, although it is unclear at this time if they will release the technical schematics needed to perform detailed troubleshooting.

While none of these products have achieved mainstream fame, and represent less well-known vendors (with the exception of Motorola), they do show that there is demand for electronic devices that are repairable, recyclable and upgradeable.

Will it eventually become mainstream? That will be driven by a combination of consumer sentiment and thresholds of infuriation. Stuck in the middle of a field with your e-tractor? You might just find yourself going rogue and reaching for the toolbox. And while we hope you don’t wind up doing time, we also hope manufacturers will focus on the future of innovation, not rearguard actions designed to thwart innovation, experimentation and progress, all while making the devices less secure and speeding their trajectory to the ever-bulging landfills in the name of bogus progress.

 

5 défi des entreprises financières (et bien d’autres) en matière de cybersécurité

Pourquoi de nombreuses organisation ont-elles du mal à suivre l’évolution du paysage des menaces et à gérer efficacement leurs cyberrisques ?

Amer Owaida

Les sociétés de services financiers sont depuis longtemps une cible populaire pour les cybercriminels. Ce n’est pas sans raison, puisqu’en plus de travailler avec de l’argent, les sociétés financières traitent un grand nombre de données sensibles sur leurs clients, que les criminels utilisent dans diverses fraudes ou vendent sur le dark web. Selon le rapport 2020 Data Breach Investigations Report, de Verizon, l’année dernière uniquement, le secteur financier a subi plus de 1 500 incidents, avec 448 divulgations de données confirmées.

En plus des menaces de longue date, la plupart des entreprises ont dû faire face à la transition rapide vers le travail à distance. Cette transition s’est faite dans un délai extrêmement court, laissant aux entreprises peu de temps pour déployer des mesures de cybersécurité adéquates ou pour préparer les employés aux cybermenaces imminentes. Et si la pandémie finit par s’estomper, le travail à distance, lui, est là pour rester. Il vient s’ajouter à la liste des défis que les entreprises doivent relever lorsqu’elles préparent leurs plans et politiques de cybersécurité. Il s’agit d’un problème auquel elles sont souvent déjà confrontées en raison de divers facteurs – nous en avons rassemblé cinq :

Le manque de main d’oeuvre de talent

Alors que de nombreuses entreprises sont à la recherche de professionnels de la cybersécurité, expérimentés ou en devenir, pour rejoindre leurs rangs et les aider à établir un périmètre défensif contre diverses menaces, ils ne sont tout simplement pas assez nombreux. En fait, bien que le déficit de main-d’œuvre en cybersécurité ait diminué pour la première fois depuis des années, il y a toujours une pénurie mondiale de 3,12 millions de travailleurs. En fait, pour combler la pénurie mondiale de talents, il faudrait que les niveaux d’emploi augmentent de 41 % aux États-Unis et de 89 % dans le monde entier. Ainsi, pour attirer les meilleurs et les plus brillants esprits de la cybersécurité, les entreprises devront offrir des salaires compétitifs et des opportunités de travail épanouissantes.

Des budgets insuffisants

L’insuffisance des budgets alloués à la cybersécurité est un facteur clé qui empêche les entreprises de s’attaquer de front aux cybermenaces. Selon une enquête menée par le cabinet de conseil Ernst and Young, 87 % des organisations interrogées ont déclaré qu’elles ne disposaient pas d’un budget suffisant pour atteindre les niveaux de cybersécurité et de résilience qu’elles visaient. Le manque de ressources signifie que les entreprises ne peuvent pas recruter suffisamment de talents en cybersécurité ou mettre en place les mesures techniques dont elles ont besoin pour être résilientes face aux diverses cybermenaces.

La surestimation de leur propre cybersécurité

Une erreur courante des entreprises est de surestimer la qualité de leurs mesures de cybersécurité. Bien qu’elles puissent croire qu’elles maîtrisent la situation, les entreprises n’ont peut-être pas mis en place les meilleures politiques de gestion des correctifs de vulnérabilité. Un bon – mais en même temps, malheureux – exemple est la vulnérabilité BlueKeep présente dans Windows. Le correctif a été publié en mai 2019, Microsoft exhortant tout le monde à procéder à cette mise à jour immédiatement. Un mois plus tard, la National Security Agency a publié son propre avertissement. Pourtant, en juillet, il y avait encore plus de 805 000 machines sensibles à cette faille de sécurité; le tout a culminé avec les premières attaques BlueKeep, en novembre de cette même année. Il va sans dire que la correction d’une vulnérabilité aussi grave ne devrait en aucun cas prendre six mois.

Le manque de formation à la sensibilisation

Le fait que les employés ne reçoivent pas suffisamment de formation de sensibilisation à la cybersécurité est un autre phénomène courant qui nuit à la cybersécurité d’une entreprise. Les risques que les employés soient incités à télécharger des logiciels malveillants ou à divulguer les informations d’identification de leur entreprise ont été amplifiés par le passage au travail à distance, alimenté par le COVID-19. Selon une étude menée par le Ponemon Institute, bien que les entreprises aient enregistré une recrudescence des cyberattaques pendant la pandémie (notamment des attaques de phishing et d’ingénierie sociale), 24 % des personnes interrogées estiment que leur organisation n’a pas dispensé une formation suffisante sur les risques liés au travail à distance. Fait inquiétant, l’étude a également révélé que plus de la moitié des entreprises n’avaient aucune politique de sécurité couvrant les besoins des employés à distance.

La sous-estimation de l’importance de la cybersécurité

Certaines organisations sous-estiment la valeur de la cybersécurité pour leur entreprise et choisissent plutôt d’investir dans d’autres aspects qu’elles jugent plus valables, comme le financement des expansions ou le développement de nouveaux produits. Elles pourraient faire valoir que les coûts sont supérieurs aux avantages, par exemple que le coût des mesures de cybersécurité est supérieur aux pertes potentielles résultant d’une violation des données. Toutefois, si les amendes et les pertes potentielles peuvent être moindres à court terme, l’atteinte à la réputation pourrait avoir des répercussions plus importantes, notamment la perte de confiance des clients, ce qui affecterait les flux de revenus. Par ailleurs, en cas de succès, les cybercriminels pourraient avoir accès à la propriété intellectuelle qu’ils pourraient vendre avec les données des clients sur le dark web. Par conséquent, la cybersécurité ne doit pas être envisagée après coup, car elle sert à protéger à la fois l’entreprise et ses clients.

Conclusion

Toute combinaison des facteurs susmentionnés pourrait constituer la tempête parfaite pour une pléthore d’organisations confrontées à une cyberattaque. Le bon côté des choses, c’est que les entreprises de services financiers ont commencé à prendre au sérieux les problèmes de cybersécurité au plus haut niveau. Le cabinet mondial de conseil en gestion McKinsey a constaté que 95 % des comités de conseil interrogés déclarent discuter des cyber-risques et des risques technologiques au moins quatre fois par an. Il convient toutefois de noter que la sensibilisation des cadres supérieurs doit aller de pair avec l’investissement de sommes suffisantes dans des solutions de cybersécurité et la formation du personnel aux meilleures normes possibles.

 

23.3.21

5 reasons why (not only) financial companies struggle with cybersecurity

 

Why do many organisations have a hard time keeping up with the evolving threat landcape and effectively managing their cyber-risks?

By Amer Oweida

Financial services companies have been a popular target for cybercriminals for a long time. Not without good reason, since beyond working with money, financial companies handle a slew of sensitive client data that criminals utilize in various fraud schemes or sell off on dark web bazaars. According to Verizon’s 2020 Data Breach Investigations Report, in the past year alone the financial industry has suffered more than 1,500 incidents, with 448 confirmed data disclosures.

In addition to the long-standing threats, most companies have had to contend with the rapid transition to remote work. The shift happened on extremely short notice, leaving companies with little time to deploy adequate cybersecurity measures or to prepare employees for looming cyberthreats. And while the pandemic will eventually subside, remote work is here to stay – adding to the list of challenges that companies need to cope with when they are preparing their cybersecurity plans and policies. This is something they often struggle with already due to various factors – we have rounded up five of them:

Talent gap

While many companies may be on the hunt for either seasoned or up-and-coming cybersecurity professionals to join their ranks and help them establish a defensive perimeter against various threats, there just aren’t enough of them to go around. In fact, although the cybersecurity workforce gap has shrunk for the first time in years, there is still a global shortage of 3.12 million workers. Actually, to make up the global talent shortfall, the employment levels would need to grow by 41% in the United States and 89% worldwide. So, to attract the best and brightest cybersecurity minds, companies will have to offer competitive salaries and fulfilling work opportunities.

Insufficient budgets

A key area that is preventing companies from tackling cyberthreats head-on is that they have insufficient budgets allocated to cybersecurity. According to a survey conducted by consulting firm Ernst and Young, 87% of surveyed organizations said that they did not have a sufficient budget to achieve the levels of cybersecurity and resilience they were aiming for. The lack of resources means that companies can’t hire enough cybersecurity talent or institute technical measures they need to be resilient when facing off against various cyber threats.

Overestimating their own cybersecurity

One common mistake companies make is that they overestimate how good their cybersecurity measures are. While they may believe that they are on top of things, companies may not have the best vulnerability patch-management policies in place. A good – but at the same time, unfortunate – example is the BlueKeep vulnerability present in Windows. The patch was issued in May 2019, with Microsoft urging everyone to patch immediately; a month later, the National Security Agency issued its own warning, yet in July there were still more than 805,000 machines susceptible to the security flaw and it culminated with the first BlueKeep attacks in November. It goes without saying that patching such a severe vulnerability should under no circumstances take six months.

Lack of awareness training

Another common occurrence that undermines a company’s cybersecurity is that employees do not receive enough cybersecurity awareness training. Arguably the risks of employees being tricked into downloading malware or parting with their company credentials have been amplified due to the COVID-19-powered shift to remote work. According to a study conducted by the Ponemon Institute, although companies have registered a surge in cyberattacks during the pandemic (including phishing and social engineering attacks), 24% of respondents felt that their organizations have not provided sufficient training about risks associated with remote work. Worryingly, the study also discovered that over half of the companies had no security policies at all covering requirements for remote employees.

Underestimating the value of cybersecurity

Some organizations underestimate the value of cybersecurity for their business and instead opt to invest in other aspects they deem more worthwhile, such as financing expansions or developing new products. They could argue that the costs outweigh the benefits, such as the cost of cybersecurity measures outweighing potential losses from a data breach. However, while the potential fines and losses may be lower in the short term, the reputational damage could lead to greater fallout including losing client trust, which would hit revenue streams. Alternatively, if successful, cybercriminals could gain access to intellectual property that they could sell along with the client data on the dark web. Therefore, cybersecurity shouldn’t be an afterthought, as it serves to protect both the company and its clients.

Conclusion

Any combination of the aforementioned factors could spell a perfect storm for most organizations when faced with a cyberattack. On the bright side, financial services companies have begun taking cybersecurity concerns seriously on the highest level. Global management consulting firm McKinsey found that 95% of the board committees that they surveyed say they discuss cyber-risks and tech risks at least four times a year. It’s worth noting, however, that building awareness in top management has to go hand in hand with investing adequate sums in cybersecurity solutions and training personnel to the best possible standards.