Mandatory IoT Security In Britain

The UK government has unveiled a new  IoT law designed to prohibit the sale of smart consumer products that fail to meet three strict security requirements.
 
In its proposal, the UK government noted that it expects 75 billion IoT devices to find their way into homes globally by the end of 2025.  This of course comes at the same time as the UK is allowing controversial 5G network manufacturer, Huawei  to become part of its IT systems network. 
 
The US government  has insisted that Huawei poses an electronic espionage risk and has urged other governments to remove Huawei equipment from mobile network infrastructure, especially as 5G deployment picks up momentum in Europe.
 
The new UK law requires manufacturers to ensure they have cyber security controls to their connected devices.and is aimed at addressing two key elements:  
 
  • First, the consumer’s privacy and safety.
  • Second, the threat of zombified IoTs being used to launch DDoS attacks and damaging the country’s economy. 
The three pillars of the new legislation are the following:
 
1. IoT device passwords must be unique and not resettable to any universal factory setting.
2. Manufacturers of IoT products provide a public point of contact as part of a vulnerability disclosure policy.
3. Manufacturers of IoT products must explicitly state the minimum length of time for which the device will receive security updates. 
 
The Draft Law, was announced on 27th January and requires  IoT device manufacturers to provide a public point of contact so that anyone can report a flaw, to be “acted on in a timely manner."
 
“Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety,” Matt Warman, UK Minister for Digital and Broadband, said in a statement. “It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”
 
The regulation was developed by the Department for Digital, Culture, Media and Sport after an extensive consultation period that kicked off in May 2019, when the UK announced it was accepting regulatory proposal for IoT security regulation. The UK government said that it aims to “deliver the legislation as soon as possible.”
 
Other IoT Regulation
The UK previously only had a voluntary “Secure by Design Code of Practice” for consumer IoT security, launched in 2018; however, this was a guidance and had no penalties for manufacturers who did not comply. However, several more solidified attempts at IoT security regulation do exist globally.
 
The closest of these to become law in the US is the California Senate Bill 327, which would require “reasonable security feature or features that are appropriate to the nature and function of the device.” SB-327, which was first proposed in 2018 and became law in January 2020. This was argued against by the security community, which said that it was a good first step but did not go far enough in regulating IoT security.
 
Over the past years, vulnerabilities in an array of devices have made headlines: including the smartwatch TicTocTrack, which was discovered to be plagued by security issues that could allow hackers to track and call children. In this respect, the UK Information Commissioner has recently introduced new standards for the protection of children's privacy
 
There have also been problems revealed in a popular smart deadbolt that could allow attackers to remotely unlock doors and break into homes; and flaws in more than 2 million IP security cameras, baby monitors and smart doorbells that could enable an attacker to hijack the devices and spy on their owners. Researchers continue to find basic security issues in IoT devices that are on the market. 
 
Threatpost:         Infosecuity Magazine:     TechNadu:       Gizmodo:       The Verge
 
You Might Also Read: 
 
Finland Has A Cyber Security Standard For IoT:
 
 
 
« The Worst Corporate Hacks In 2019 Could Have Been Prevented
Smart Cities Will Soon Be Under Attack »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Resecurity, Inc.

Resecurity, Inc.

Resecurity is a cybersecurity company that delivers a unified platform for endpoint protection, risk management, and cyber threat intelligence.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

Grid32

Grid32

Grid32 provides independent computer system and physical security audit services to government and corporate clients of all sizes.

Thales

Thales

Thales provides solutions, services and products that help its customers in the defence, aeronautics, space, transportation and digital identity and security markets to fulfil their critical missions.

IDpendant

IDpendant

IDpendant offers a wide range of services, including authentication technology, client security products, single sign on systems, encryption solutions, card and mobile device management systems.

ThreatBook

ThreatBook

ThreatBook is dedicated to providing real-time, accurate and actionable threat intelligence to block, detect and prevent attacks.

SANS CyberStart

SANS CyberStart

SANS CyberStart is a unique and innovative suite of tools and games designed to introduce children and young adults to the field of cyber security.

Connectria

Connectria

Connectria provides cloud hosting, remote monitoring, and compliant cloud security solutions and services to enterprises, medium and small businesses.

IP2Location

IP2Location

IP2Location provide services to identify geolocation by IP address, and to detect IP addresses associated with anonymous proxy servers, which are often used for fraud and spamming purposes.

Focal Point

Focal Point

We aspire to be the focal point for Medium and Small size companies providing 24/7 cyber security advice, services and solutions.

Boxphish

Boxphish

Boxphish provides a proven solution to reduce Human Error and Cyber Human Risk via automated learning journeys and intelligent phishing simulations.

DoQubiz Technology

DoQubiz Technology

DoQubiz is using the idea of security through obscurity to develop their proprietary Fractal Security Engine that implements a highly resilient data protection protocol.

VectorRock

VectorRock

Save Your Business From Cyber Criminals. We specialize in uncovering cyber risks which threaten your organization and fixing them.

Kingston Technology

Kingston Technology

Kingston is a leading global manufacturer of memory and storage solutions including encrypted storage solutions to protect data inside and outside the firewall.

Information Security Officers Group (ISOG)

Information Security Officers Group (ISOG)

ISOG's mission is to strengthen information security through awareness and education programs, promoting community and fellowship among information security leaders.

Zitec

Zitec

One of Europe's largest and most prominent full-cycle software development services companies, Zitec is the digital transformation partner to companies in the EU, UK, USA, Canada and ME.

Evolver

Evolver

Evolver delivers technology services and solutions that improve security, promote innovation, and maximize operational efficiency in support of government and commercial customers.

Vector Choice Technologies

Vector Choice Technologies

Vector Choice Technology Solutions has a long standing reputation in cyber security consulting since 2008.