Realistically, IoT devices are and will continue to be made by small development teams under considerable time pressure with little motivation to care about security over the life of the product.
One solution to this problem is to institute consumer protection laws that say that consumers can return the product for a full refund if an exploitable security flaw is discovered in the device, and that products must disclose the privacy implications of using them.
Another option is to improve the software ecosystem for IoT to the point where everything is secure-by-default and you have to go out of your way to do something in an insecure manner. That will require a lot of careful API design and probably abandoning C and C++ in favor of something safer. (Rust seems like the most promising alternative at the moment.)
A useful test of whether or not we've succeeded is whether a hobbyist with basic programming knowledge can, with low effort, deploy a custom embedded device that connects to the Internet and have high confidence that it isn't a privacy threat or vulnerable to known security attacks and it will continue to be secure for the life of the product.
I think the full solution has got to be some mix of consumer protection laws and better tools for deploying secure devices. Maybe also some third-party validation organization could get involved, analogous to UL listing for electrical things.
One solution to this problem is to institute consumer protection laws that say that consumers can return the product for a full refund if an exploitable security flaw is discovered in the device, and that products must disclose the privacy implications of using them.
Another option is to improve the software ecosystem for IoT to the point where everything is secure-by-default and you have to go out of your way to do something in an insecure manner. That will require a lot of careful API design and probably abandoning C and C++ in favor of something safer. (Rust seems like the most promising alternative at the moment.)
A useful test of whether or not we've succeeded is whether a hobbyist with basic programming knowledge can, with low effort, deploy a custom embedded device that connects to the Internet and have high confidence that it isn't a privacy threat or vulnerable to known security attacks and it will continue to be secure for the life of the product.
I think the full solution has got to be some mix of consumer protection laws and better tools for deploying secure devices. Maybe also some third-party validation organization could get involved, analogous to UL listing for electrical things.