D-Link To Undergo Security Audits For 10 Years as Part of FTC Settlement

D-Link has agreed to a settlement with the US Federal Trade Commission in regards to a 2017 lawsuit in which the US government agency accused the Taiwanese hardware maker of misrepresenting the security of its devices and ignoring vulnerability reports. From a report: As part of the settlement, D-Link has promised to implement a new software security program for its routers and Internet-connected cameras. The company has also agreed to subject itself to ten years of biennial security audits from a third-party, independent auditor. The FTC gets to choose the auditor, while D-Link got to decide the certifications the auditor must obtain before allowing it to review its security program.

Re:

[jellomizer]

It will depend on how much effort you put in watching the company.
Companies, rename, sell part of its business, those sold parts will get renamed, new business units are created, or bought.

So that next Cisco gear, may have been a Refurbish D-Link product, just in a new case.

Now with *guaranteed* backdoors. ;)

[Anonymous Coward]

Thanks. I'll stay with my custom solution. Yes, it will be more secure than theirs. If only because it is not made by somebody untrustworthy, it is profit-free, and because it is not hard to be better at it than D-Link. ;)

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[Aighearach]

wait, WHAT? You build your own hardware????

You don't build your own hardware to implement a "custom solution," you use a general purpose computing device, also known as a "computer," and you install an operating system on it that you know how to configure as a router.

Can't get any worse... I think...

[The Cynical Critic]

Considering the rather embarrassingly bad level of security in D-Link products overall I suppose it can't really get any worse. However I don't trust the third party to actually be that independent or perform thorough audits.

However if they get rid of the admin accounts with standardized passwords that you can't remove or change the password on then at least that's something. It's obviously not good enough for me or anyone else familiar with their lack of security to consider their products, but at least that should slightly reduce the size of the botnets created from their devices bought by people who don't know any better.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:

[account_deleted]

Comment removed based on user account deletion

Comment removed

[account_deleted]

Comment removed based on user account deletion

3rd-party audits are not SW freedom for users.

[jbn-o]

It's not a bad idea to have a different group looking over your work. In the software world we call it the QA team. They basically perform everything the average attacker would do on your software while you adhere to security guidelines yourself and do your best not to be embarassed before the QA team gets to review your work.

But "ten years of biennial security audits from a third-party, independent auditor" (as the article described it) is not software freedom [gnu.org] for the users. These alleged audits are indis