As computing becomes embedded everywhere, privacy, security and safety issues converge.
Devices, networks, and services and insecure yet they process more data
As computing becomes embedded everywhere, privacy, security and safety issues converge. In the future, our infrastructure will be insecure and unsafe due to insecure devices and components that are not patched.
As more devices become ‘connected’ and services become ubiquitous, they may generate and collect massive amounts of data in excess of what is necessary for the provision of the specific service or function. For instance, the “always on” nature of connected or smart devices and the granularity of data collected potentially enables the provider and other parties access to vast types and volumes of data.
A mere software update or change in business practice can change the frequency of sharing and the parties to whom data can be transmitted can change at any point in time.
Securing these technologies becomes even more challenging as they are embedded in complex systems, difficult to alter or update for security purposes, and control by the individual is limited. Too often companies decide for business reasons they will no longer support the software or hardware, including for security updates when vulnerabilities are found, leaving consumers unprotected.
This creates an unsafe environment. Unpatched, insecure, and unmaintained systems and infrastructure leave us vulnerable.
What we need to see: protection by security
Principle 4. No barriers to security
There should be no barriers to timely fixes in security -- including updates, patches, and workarounds -- particularly considering implications for users of various socio-economic status and citizenship. Security updates should be distinguishable from feature updates.
Principle 3. Security and privacy by design
Manufacturers and/or vendors must be responsible for the security and privacy design in the products they manufacture and sell, throughout a clearly identified period.
Principle 2. Data should be protected
Data should be protected from access by persons who are not the user.