Timeline for Is there a certificate to indicate the security level of IoT devices?
Current License: CC BY-SA 3.0
8 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 18, 2018 at 21:07 | comment | added | Helmar♦ | @Gilles the whole thing isn't really my question after all. Personally I don't think too highly of any certification really :P | |
| Jan 18, 2018 at 21:06 | comment | added | Helmar♦ | @Gilles I agree one could only certify the quality processes of the software development or something like that. Certifying every software version is not really an option. | |
| Jan 15, 2018 at 19:01 | comment | added | Gilles 'SO- stop being evil' | @Helmar Unfortunately, serious certifications are pretty much inherently a heavyweight process. Certifying the initial version and the update process is one thing, but certifying each update before it's deployed adds a significant overhead, which makes it difficult to establish a good certification process (where security updates would have to be certified after the fact — which goes against the grain of certification, since it means the device will run non-certified versions). | |
| Jan 15, 2018 at 8:48 | comment | added | Helmar♦ | Certifications could very well include support life-times or the ability for firmware updates—even openness. So while you're correct that those are very important points I don't quite see why they are incompatible with certifications in general. | |
| Jan 15, 2018 at 8:47 | history | edited | Helmar♦ | CC BY-SA 3.0 |
added 9 characters in body
|
| Jan 15, 2018 at 5:56 | comment | added | vidarlo | The point is that bugs can be found in unlikely places (CPUs), and in well known software (Heartbleed), thus we need patching and updating of software. But yes - there is a plethora of bugs to choose from. | |
| Jan 14, 2018 at 22:47 | comment | added | Gilles 'SO- stop being evil' | Heartbleed may be a system-class bug from a system deployment point of view, but it's still a bug in a specific piece of software that just needs to be upgraded. Better examples would be attack on the protocol itself, such as BEAST and CRIME. | |
| Jan 14, 2018 at 19:44 | history | answered | vidarlo | CC BY-SA 3.0 |