The unprecedented ransomware attack that started on 12th May was wholly predictable and a wakeup up call of reality to a sleepwalking world.
Everyone seems to have a view on the attack with traditional media and social media being red hot with comments and finger pointing; according to Microsoft it’s all the fault of the NSA . In today’s world this is to be expected but it is only through serious investigation that the truth will be uncovered and this is the role of the authorities, supported by experts. We can all only hope they succeed in their endeavours.
We must resist the temptation of naivety. Our industry is renowned for its ability in providing innovation and making possible today what was only a dream yesterday but that ability brings with it the paradox that has been with us since the first computer was designed; the products which are launched on the market, either hardware of software, are vulnerable. No manufacturer of IT products can pretend their systems are without a hole or a door that ill-intentioned and very determined individuals or organisations can enter to either steal our identities, to spy on our private lives or to kill our businesses. It is a very reasonable paranoia to declare that WannaCry is just a taste of our future and a clarion call of what is to come.
There are many ongoing debates around the world with purpose of setting up rules, providing guidance and introducing policies to deal with the threat so we can be prepared. For example in the US one debate is clearly described in a report under the title “Law Enforcement Using and Disclosing Technology Vulnerabilities” . The questions raised in this report can be condensed as, should we make public a vulnerability to which there is no associated fix and how should we organize and reward the community of “good guys” that detect the vulnerabilities and fix them before hackers exploit them? Those who read the report will be disturbed to discover that security agencies are playing on 2 boards of the same game by exploiting for their own needs the vulnerabilities. This is the real world we are living in and we will not change it by simply trying to wish it away. We have to face the facts and be cognisant of reality.
Contained within the report is a detail which is of most interest for our secondary market industry. On Page 2 is a short but clear definition in a grey box under the title Relevant Terms. Vulnerability is defined as “a security hole or weakness in hardware, software, or firmware that can leave it open to becoming compromised.” Previous attempts at defining vulnerabilities have never been as clear. Reviewing the “Common and Vulnerabilities Exposures” (CVE) web site we can read : “A “vulnerability” is a weakness in the computational logic (eg. code) found in software and some hardware components (eg. firmware)…”. We are glad that the definition provided in the report takes us one step further than the CVE definition with the clear distinction between hardware, firmware and software being independently potential sources of vulnerability that require discreet fixes. This definition reflects the point of view of Free ICT Europe despite the many debates and attempts by OEMs and Software Companies to make it confusing.
For our precious secondary market to move forward and be a part of a secure future the lessons to be learned are easy to summarise:
The last point in the list is one of the main positions we defend at Free ICT Europe. We have tirelessly campaigned to raise the awareness of the stakeholders and are heavily involved in the legislative agenda of the European Commission.
In discussions with the new initiative of Directive for Ecodesign , we have successfully introduced the obligation on an OEM to provide firmware updates in to their project. This is just a first step but we will not giving anything away.
To enable us to reach the goals that will benefit us all your support is more than precious and we are thankful for your contributions. The very future of our industry is in our collective hands.
Don’t give up, be part of the solution and join us. We need you, you need us, we all need each other.
Are you an ICT Secondary Market provider?
Then please join our alliance, as we need your help to raise our voice.
FIE has become a serious partner in Brussels, please join the alliance, so that we can continue to expand our reach and gain more attention representing businesses like yours.
JoinAs a Foundation we are depending on the gifts we receive. Please consider to support us financially, your contribution is appreciated & needed!
Thank you in advance,
Subscribe to our newsletter so that we can share more about our activities and the issues our industry is facing. We also encourage other companies to share their story.
Subscribe