US-CERT study predicts machine learning, transport systems to become security risks

The Carnegie-Mellon University's Software Engineering Institute has nominated transport systems, machine learning, and smart robots as needing better cyber-security risk and threat analysis. That advice comes in the institute's third Emerging Technology Domains Risk Survey, a project it has handled for the US Department of …

[jake]

I believe there is only one word in answer to this:

"Duh!"

[Aodhhan]

Re: I believe there is only one word in answer to this:

This isn't a report meant for information security professionals. It's written for higher level executives about the technology challenges ahead. Take the time to read through it all before you jump at the chance to publicly roll your eyes.

Also, the fact you 'dismiss' anything coming from Carnegie Mellon University displays your absolute ignorance towards information security. CMU is the #1 university in the world when it comes to information security and information technology research.

[Herby]

Nothing...

Will go wrong go wrong go wrong...

[Steve Davies 3]

Oblig

"Computer Says No!"

And you won't be able to argue the toss with an AI.

This has to be followed by the inevitable

"We are Doomed I tell ye, doomed."

[Charles 9]

How soon before some Luddite goes, "Electricity is overrated."?

[jake]

That's "Neoluddite, Sir!" to you ...

There are many things that are usually done with electricity these days that are better/more efficiently done in other ways.

[Charles 9]

Re: That's "Neoluddite, Sir!" to you ...

Some examples would be nice.

[Anonymous Coward]

Apocalypse IoT

Well, on the flip side: Hollywood thrillers might get things right for once, latest Fast & Furious etc. Plus we'll have more episodes of 'Black Mirror'!

[jake]

Re: Apocalypse IoT

I seriously doubt it. Hollywood employs script kiddies^W^Wwriters specifically to mangle any given story so it no longer resembles anything new.

[Anonymous Coward]

Robotic Surgeons

From experience of working on one "robotic" brain surgery product (that has been operational successfully for years), I can say that at least standing between development and deployment is a rightfully bewildering set of compliance mountains to overcome. Getting FDA permissions for these machines is not easy, and I am thankful for the huge pressures exerted by these organizations on the development processes.

I predict that getting certification will become harder and even more technical, possible requiring machine validation of the code etc (proofs). Presently most human safety software regulation focuses on the development process, and not on the software itself (the 'how', not the 'what').

My concern would be that the areas that are newly being automated, the IOTs and entry of robotics into new areas will be lightly regulated, with overwhelming financial pressures being placed on governments to permit or just have 'light touch' standards. Self driving cars is one such area. As an old-hand programmer I can't believe for a second that these machines are anywhere near safe, for a long list of reasons, and I have been shocked at the public and governments attitude to permitting software engineers to give their shitty code near full control of cars and trucks etc. Its like they are living in an alternative reality, definitely drinking far too much Kool-Aid. 20 years of experience and neither Google nor Microsoft can secure a browser. What hope is there to develop safe software capable of autonomously driving a car?

[Charles 9]

Re: Robotic Surgeons

"...for a long list of reasons..."

I'd love to hear some, as well as the reasons humans not only can do them better but perhaps always will do it better, given human accident history.

[Anonymous Coward]

Re: Robotic Surgeons

The reasons why it is so technically difficult to write safe software? There is so many it really is difficult to list. To sign off on the control system for an autonomous vehicle responsible for transporting humans in traffic? Fucking hell... that's scary difficult.

Its not about "its better than humans". That a popular fallacy. That argument doesn't cut it when signing off on safety systems. You need to attest that it meets agreed specification, and I don't think you will get specifications worded like "must be better than most drivers" or "better than the average driver". Right or wrong, when little Johnny kills himself and his passengers because of his own lack of skill and poor judgement, its viewed as a tragedy. Watch what happens when Johnny and his passengers are killed because of e.g. Ford's software... it wont be nice for Ford.

Writing even relatively simple software to be without bugs seems so difficult most companies fail. This shouldn't need elaborating on. Writing software well is hard, and most companies don't even bother to begin trying to do it right.

Take a read around Toyota's unintended acceleration case for an insight into the reality of the software controlling the braking system of a car (not autonomously), and which may have been involved in a fatality. Look at the reports on the software, and how the company reacted. Extrapolate now from that to the complexity of an autonomous system responsible for the safety of all the passengers.