Question
What counts as a "product" in product cybersecurity?
Answer
Anything a company sells or provides to customers that contains digital elements: physical devices, mass-deployed software, and cloud services provided to customers.
The term covers far more than consumer gadgets. An insulin pump, a car, a train, a PLC in a factory, a smart watch, a router, a mobile app and the cloud backend that updates all of them are products. The test is whether the thing leaves the company and runs in someone else's hands. A kitchen knife has no digital element, so it is out. A smart fridge is in, because once it is connected, its software can be attacked.
That is why the discipline is separate from information security, which protects the company's own corporate IT. Product security protects what the company ships, and with it the customer and the company's reputation.
Go deeper:
European Commission — Cyber Resilience Act — the legal definition of a "product with digital elements"
Note saved — thanks!
Question
Which historical incidents kick-started product security in critical infrastructure, IoT, medical devices and automotive?
Answer
Stuxnet (2010) for critical infrastructure, FX's Huawei router hacks (2012) for IoT devices, Barnaby Jack's remote insulin pump attack for medical devices, and the remote Jeep hack (2015) for automotive.
* From Stuxnet to FortiGate, the bug classes stay familiar while the number of affected customers grows. *
| Incident | What happened | What it started |
|---|---|---|
| Stuxnet, 2010 | Malware carried on USB drives reprogrammed Siemens SCADA controllers and destroyed Iranian uranium centrifuges | Security for critical infrastructure and industrial control |
| Huawei routers, 2012 | FX (Felix Lindner, Recurity Labs) showed exploitable flaws in Huawei routers | The wave of router hacks and the focus on IoT device security |
| Medtronic insulin pump | Barnaby Jack showed he could command a pump remotely, including a lethal dose | Medical device security |
| Jeep Cherokee, 2015 | Charlie Miller and Chris Valasek took remote control of steering and brakes over the car's cellular connection | Automotive cybersecurity (recall of 1.4 million vehicles) |
| VTech, 2015 | A toymaker's breach leaked millions of records of parents and children | Awareness of insecure consumer IoT |
| Newag trains, 2023 | Researchers found code that disabled trains serviced by competitors, and were sued | Shows some manufacturers still haven't learned the lesson |
Each case made an industry realise that its products had become computers. After that, regulators and customers started asking for security.
Go deeper:
- WIRED — Hackers remotely kill a Jeep on the highway (2015) — the first-hand account of the Miller and Valasek demo
- Stuxnet (Wikipedia) — how the worm reached and sabotaged the PLCs
- BioSpace — Hacker shows off lethal attack by controlling wireless medical device — Barnaby Jack's insulin pump demo
- Railway Technology — The story of the great Polish train hack — the Newag case and the lawsuit against the researchers
Note saved — thanks!