Specific security regulation is not necessary, because the solution is simple: liability.<p>If a product leaks pictures of your kids to the internet when it is used normally, the product is <i>defective</i>. If the problem was caused by a bad design[1], then the manufacturer should be liable for their negligence.<p>Yes, this would make entire categories of currently-used software unusable. It would probably require recalling many current and upcoming products. Adding complex network features (or any network connectivity at all) would also add liability risk, so this would also discourage (but not ban) throwing internet connectivity on everything.<p>As Dan Geer recommended[2], when the product is Free Software (including the build environment), the end user has the ability to defend themselves, liability can probably be limited to a refund. However with proprietary software or embedded devices where changing the software is not practical, the manufacturer should be liable for any damage their products cause.<p>I&#x27;m sure there will be a lot of resistance to this idea, as many products currently <i>rely</i> on bad design (smart TVs, nest), but allowing a security-free internet of things to happen would be a yet another Sword Of Damocles hanging over our head. Liability may be bad, but the problems that will happen if we connect everything to the internet without serious  would be much worse.<p>[1] &quot;bad design&quot; would not include things outside o f the manufacturer&#x27;s control, such as new way to weaken crypto or a completely new attack method. Buffer overflows, protocol design problems, incorrect configuration or permissions, unauthenticated updates or other downloads, and sending plaintext over a network <i>should</i> count.<p>[2] <a href="http:&#x2F;&#x2F;geer.tinho.net&#x2F;geer.blackhat.6viii14.txt" rel="nofollow">http:&#x2F;&#x2F;geer.tinho.net&#x2F;geer.blackhat.6viii14.txt</a>