Tag Archive for: Ratings

74% say connected cars and EV chargers need cybersecurity ratings


74% say connected cars and EV chargers need cybersecurity ratings

Aurich Lawson | Getty Images

Almost 3 in 4 people think that connected cars and electric vehicle chargers should be rated for their ability to resist cybersecurity threats. That’s the finding from a survey conducted last week by BlackBerry to see whether people consider Internet-connected devices (also known as the Internet of Things) to be secure from hacking threats.

The survey was commissioned in response to a new White House initiative announced on Wednesday. The Biden administration plans to launch a labeling program for IoT devices in 2023, similar to the EnergyStar ratings that tell consumers how much electricity a TV or appliance will use.

The White House wants the National Institute of Standards and Technology and the Federal Trade Commission to come up with a basic set of security standards so that Americans can tell at a glance whether that new speaker or washing machine is in danger of joining a botnet or getting hit with ransomware.

Perhaps alarmingly for Ars readers, only 54 percent of the 1,008 people surveyed said they are concerned about Internet-connected devices in their homes being hacked. And just 32 percent said they own IoT devices that they do not let access the Internet due to security concerns. But 82 percent agreed that a cybersecurity rating like EnergyStar would make them feel more informed about connected devices.

BlackBerry also asked, “Do you think a cybersecurity/’star rating’ system should be extended to connected cars and electric vehicle charging stations?” Overwhelmingly, respondents did, with 74 percent agreeing with that statement.

There’s no indication yet that the White House, NIST, or the FTC plan to include connected cars or EV chargers in the new labeling scheme, but there’s probably a better chance of that happening than every connected car being fitted with a physical kill switch to disconnect it.

Source…

SecurityScorecard taps HackerOne to bring bug bounty data to security ratings


Join Transform 2021 this July 12-16. Register for the AI event of the year.


HackerOne and SecurityScorecard have announced a platform integration that will showcase data from the ethical hacking community on a company’s digital scorecard.

SecurityScorecard, for the uninitiated, is a cybersecurity rating and risk-monitoring platform major companies such as Nokia, AXA, and Liberty Mutual use to monitor and assess security throughout their supply chain, including weaknesses in third-party vendors. It’s kind of like a credit score rating for security.

HackerOne, meanwhile, connects businesses with security researchers, or “white hat hackers,” who are financially incentivized to find software vulnerabilities before bad actors do. The HackerOne platform has powered bug bounty programs for major businesses, including Microsoft, Google, Intel, the U.S. Department of Defense, and Goldman Sachs. The San Francisco-based company recently touted major enterprise growth, with nearly half of its new sales stemming from businesses with over $1 billion in revenue.

Risk categories

SecurityScorecard uses 10 broad risk categories as part of its rating system, including endpoint security, network security, DNS health, and patching cadence. It also uses a risk category it calls “hacker chatter,” which automatically collects and analyzes conversations from popular public hacker community channels, such as private forums, social networks, and internet relay chat (IRC). It’s all about finding mentions of a business and its associated digital properties to assess whether any potential undisclosed exploits are being discussed.

This latest partnership with HackerOne builds on that basic concept, though it instead surfaces official bug bounty and vulnerability disclosure data gleaned from HackerOne’s API.

Above: HackerOne score in SecurityScorecard

For SecurityScorecard customers, a “hacker report” signal will appear on scorecards for companies that use HackerOne, though this is on an entirely opt-in basis.

Enterprises will be able to see recent security issues involving companies in their supply chain and take appropriate action — with the ability to download a CSV file…

Source…

Security company finds some e-ticketing links exposed to hackers – Airline Ratings

Security company finds some e-ticketing links exposed to hackers  Airline Ratings

E-ticketing systems at some airlines are using unencrypted links that may expose customers’ personal information to hackers, according to threat experts at …

“mobile security news” – read more