Consumer Reports To Consider Cyber Security in Product Reviews (reuters.com) 47
Consumer Reports, an influential U.S. non-profit group that conducts extensive reviews of electronic products, cars, kitchen appliances and other goods, is gearing up to start considering cyber security and privacy safeguards when scoring products. From a report: The group, which issues scores that rank products it reviews, said on Monday it had collaborated with several outside organizations to develop methodologies for studying how easily a product can be hacked and how well customer data is secured. Consumer Reports will gradually implement the new methodologies, starting with test projects that evaluate small numbers of products, Maria Rerecich, the organization's director of electronics testing, said in a phone interview. "This is a complicated area. There is going to be a lot of refinement to get this right," Rerecich said. The effort follows a surge in cyber attacks leveraging easy-to-exploit vulnerabilities in webcams, routers, digital video recorders and other connected devices, which are sometimes collectively referred to as the internet of things.
About damn time... (Score:4, Interesting)
...and really, most products should get terrible marks to start with.
This is in many ways what IIHS did, that compelled the auto industry to make ever safer cars. The NHTSA crash testing is so hobbied by laws designed to make it ineffective that it took the insurance companies, tired of paying out claims for AD&D to embarrass car makers into making safer cars.
I have a feeling that if Consumer Reports isn't successful, increasing payouts by insurance companies when breaches occur might be.
Re: (Score:2)
No one likes getting locked up, and try getting that out of the upholstery after the surprise of seeing a dragon...
Re: (Score:2)
tired of paying out claims for AD&D to embarrass car makers into making safer cars.
People were outing AD&D players at car makers to embarrass them into making safer cars?
Wow. I knew there was some social stigma, but... Wow.
Re:Don't believe it will help (Score:4, Insightful)
Re: (Score:3)
When someone can hack your thermostat, you are going to care!
When somebody hacks your thermostat, you are (probably) going to care. Nobody gives a rat's ass until the consequences are tangible.
Re: (Score:1)
And that's assuming that they change the settings. If somebody hacks your thermostat, leaves the settings along, and uses it as part of a DDOS attack, there will still likely be zero cares given.
-gnick
Re: (Score:2)
Re: Don't believe it will help (Score:2)
Re: (Score:2)
I guess I was too general when I said "nobody gives a rat's ass". I should have said, "A typical user will not give a rat's ass until after there are tangible consequences." Unless there were widespread reports of systems being hacked and damage being done, most users will not bother to secure anything nor care about how easy they are to hack.
Re: (Score:2)
Re: (Score:2)
Same standard - I may have phrased things badly. When I said "tangible consequences," I didn't mean necessarily directly to the user. Just evidence that there have, indeed, been consequences. Right now, nobody's successfully blamed a fire or freeze on hackers to my knowledge, so "nobody's" doing anything to secure against it.
Re: (Score:1)
Yay! (Score:3)
This is great. I've been promoting the idea that independent test labs such as uL, or standards such as the CE mark, should include product security as well. Having consumer ratings include them could significantly increase awareness of security. We, as tecnhologists and consumers, really need to hit hard against companies selling inherently insecure products. With the rise of botnets, insecure products are no longer just a threat to our own networks, but to national security as well.
Re: (Score:1)
Re: (Score:2)
I wonder what the tests will be. Run NMAP perhaps? Check web pages behind log-in screens are not accessible? Look for exploits like unsanitised input?
Or some kind of meta check, based on previous performance of the manufacturer, frequency of updates etc.
Re: (Score:2)
Yeah, others have questioned if CR has the skills to do this. I hope they hire some real security people. Your "meta check" concept would be pretty weak, but that is the kind of thing they might do.
Are they qualified? (Score:2)
Re: (Score:3)
"
Re: (Score:2)
Here is what they are using as criteria: https://thedigitalstandard.org... [thedigitalstandard.org]
Re: (Score:2)
Here is what they are using as criteria: https://thedigitalstandard.org... [thedigitalstandard.org]
No...that's what they are saying they are using as criteria. Knowing where to look something up and understanding it are different things. I don't believe Consumer Reports will be hiring any real security experts to conduct their reviews. They'll do the same thing they've always done--best effort approach using reviewers who know how to meet deadlines for writing review text. If you're an expert in a field, you don't take advice from Consumer Reports. Just look at their reviews for product areas in whi
Re: (Score:2)
It's nice that they've added a column to their matrices about "Security", but for me, a dot in that column is meaningless.
...but perhaps no dot in that column is cause for huge concern/outright dismissal for even considering the product.
Re: Are they qualified? (Score:2)
Re: (Score:2)
They're probably not qualified, in that it's consumer reports.
They review stuff for the masses - if you're an expert in the field, you already know what to look for and thus they don't contribute anything. However, if you're not already in the know, they test things as "Jo
Re: (Score:3)
Anonymous Cowards are all trolls living in their mom's basement.
Will they include Manufacturer data access? (Score:4, Interesting)
One of the first things I thought of when I read this is how would they rate a Windows 10 PC, Mac or a Chromebook? What about a smartphone or tablet? Even many PCs with Linux already installed would be suspect with different packages that come with the system.
It's great that they'll rate connected appliances, cars and streaming boxes but that's leaving out the classes of devices which are the biggest risk to consumers data - the systems they handle almost literally 24 hours a day.
Ironically, CR doing this is a great way of making the great unwashed more aware and concerned about their cyber-security.
Re: (Score:2)
Ironically, CR doing this is a great way of making the great unwashed more aware and concerned about their cyber-security.
How is something doing what it's intended to do in any way ironic?
Cyber (Score:3)
Say "cyber" one more time...
now if we can only get (Score:2)
manufacturers to consider cyber security and privacy we'll be good to go.
No no no (Score:2)
Consumer Reports has shown REPEATEDLY that they don't know shit about computing, and I'd bet they don't know shit about cyber security either.
Their articles will contain shit like "use complex passwords", "use an anti-virus program", and "don't click on pop-up ads".
Fucking ninnies. They're good at hardware testing (usually) for cars and appliances but in the realm of computing they've proved to be dunderheads more times than I can count. Plus, computing is a moving target- the shit they test or advise on wi
Actual Job Posting (Score:1)
A copy of the two job descriptions:
https://jobs-consumers.icims.com/jobs/2778/product-testing---cybersecurity/job?mode=job&iis=Indeed&iisn=Indeed.com&mobile=false&width=1170&height=500&bga=true&needsRedirect=false&jan1offset=-300&jun1offset=-240
And also an Intern position in IS:
https://jobs-consumers.icims.com/jobs/2786/2017-summer-intern%2c-information-security/job?mode=job&iis=Indeed&iisn=Indeed.com
Key Responsibilities:
Within Privacy, manages complex pro
New subject for Consumer Reports (Score:1)
Wish CR was still "non-profit" (Score:1)
But around 2008 they switch to a pay for ratings and it was VERY OBVIOUS. Models that one month rated at the bottom of the list started showing up at the top of the list. Also, you can see models that have very public recorded issues still show up at the top of the list.
Sorry, but CR is no longer a reliable source for honest non-bias reviews of products.