Mandatory IoT Security In Britain

The UK government has unveiled a new  IoT law designed to prohibit the sale of smart consumer products that fail to meet three strict security requirements.
 
In its proposal, the UK government noted that it expects 75 billion IoT devices to find their way into homes globally by the end of 2025.  This of course comes at the same time as the UK is allowing controversial 5G network manufacturer, Huawei  to become part of its IT systems network. 
 
The US government  has insisted that Huawei poses an electronic espionage risk and has urged other governments to remove Huawei equipment from mobile network infrastructure, especially as 5G deployment picks up momentum in Europe.
 
The new UK law requires manufacturers to ensure they have cyber security controls to their connected devices.and is aimed at addressing two key elements:  
 
  • First, the consumer’s privacy and safety.
  • Second, the threat of zombified IoTs being used to launch DDoS attacks and damaging the country’s economy. 
The three pillars of the new legislation are the following:
 
1. IoT device passwords must be unique and not resettable to any universal factory setting.
2. Manufacturers of IoT products provide a public point of contact as part of a vulnerability disclosure policy.
3. Manufacturers of IoT products must explicitly state the minimum length of time for which the device will receive security updates. 
 
The Draft Law, was announced on 27th January and requires  IoT device manufacturers to provide a public point of contact so that anyone can report a flaw, to be “acted on in a timely manner."
 
“Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety,” Matt Warman, UK Minister for Digital and Broadband, said in a statement. “It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”
 
The regulation was developed by the Department for Digital, Culture, Media and Sport after an extensive consultation period that kicked off in May 2019, when the UK announced it was accepting regulatory proposal for IoT security regulation. The UK government said that it aims to “deliver the legislation as soon as possible.”
 
Other IoT Regulation
The UK previously only had a voluntary “Secure by Design Code of Practice” for consumer IoT security, launched in 2018; however, this was a guidance and had no penalties for manufacturers who did not comply. However, several more solidified attempts at IoT security regulation do exist globally.
 
The closest of these to become law in the US is the California Senate Bill 327, which would require “reasonable security feature or features that are appropriate to the nature and function of the device.” SB-327, which was first proposed in 2018 and became law in January 2020. This was argued against by the security community, which said that it was a good first step but did not go far enough in regulating IoT security.
 
Over the past years, vulnerabilities in an array of devices have made headlines: including the smartwatch TicTocTrack, which was discovered to be plagued by security issues that could allow hackers to track and call children. In this respect, the UK Information Commissioner has recently introduced new standards for the protection of children's privacy
 
There have also been problems revealed in a popular smart deadbolt that could allow attackers to remotely unlock doors and break into homes; and flaws in more than 2 million IP security cameras, baby monitors and smart doorbells that could enable an attacker to hijack the devices and spy on their owners. Researchers continue to find basic security issues in IoT devices that are on the market. 
 
Threatpost:         Infosecuity Magazine:     TechNadu:       Gizmodo:       The Verge
 
You Might Also Read: 
 
Finland Has A Cyber Security Standard For IoT:
 
 
 
« The Worst Corporate Hacks In 2019 Could Have Been Prevented
Smart Cities Will Soon Be Under Attack »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Directory of Cyber Security Suppliers

Directory of Cyber Security Suppliers

Our Supplier Directory lists 8,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

CyTech Services

CyTech Services

CyTech provides unique services and solutions complemented with professional subject matter experts to both the Federal and Commercial sectors.

HANDD Business Solutions

HANDD Business Solutions

HANDD are independent specialists in data protection with expertise at every stage of the Protect, Detect and Respond cycle, from consultancy and design, right through to installation.

Certification Europe

Certification Europe

Certification Europe (now Amtivo Ireland) is an accredited certification body which provides ISO management system certification, including ISO 27001.

KLC Consulting

KLC Consulting

KLC Consulting offers information assurance / Security, IT Audit, and Information Technology products and services to government and Fortune 1000 companies.

Codified Security

Codified Security

Codified is a testing platform for mobile application software. We make it easier than ever for companies to detect and fix security vulnerabilities and ensure their applications are compliant.

Cyber Science

Cyber Science

Cyber Science is the flagship conference of C-MRiC, focusing on pioneering research and innovation in Cyber Situational Awareness, Social Media, Cyber Security and Cyber Incident Response.

Police Digital Security Centre (PDSC)

Police Digital Security Centre (PDSC)

PDSC is a not-for-profit organisation, owned by the police, that works across the UK in partnership with industry, government, academia and law enforcement.

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric cybersecurity practitioners charged with defending hybrid cloud environments.

Bugbank

Bugbank

Bugbank (aka Vulnerability Bank) is a leading SaaS platform for internet security services in China.

Debevoise & Plimpton

Debevoise & Plimpton

Debevoise & Plimpton LLP is a premier law firm with market-leading practices in areas including Data Strategy & Security.

RecoLabs (Reco)

RecoLabs (Reco)

Reco empowers organizations to discover their SaaS applications, identities, and data, control access and prevent the risk of exposure.

Software Improvement Group (SIG)

Software Improvement Group (SIG)

Software Improvement Group helps business and technology leaders drive their organizational objectives by fundamentally improving the health and security of their software applications.

Pillr

Pillr

Pillr is a cybersecurity operations platform capable of adapting to the demands of your business and team — and the global threat landscape.

Computacenter

Computacenter

Computacenter is a leading independent technology partner, trusted by large corporate and public sector organisations. We help our customers to source, transform and manage their IT infrastructure.

Pointsharp

Pointsharp

Pointsharp delivers software and services that help organizations secure data, identities, and access in a user-friendly way.

Alchemy Security Consulting

Alchemy Security Consulting

Alchemy Security Consulting specialise in offensive and defensive cyber security. We find the weak link in your security so you can patch it up fast and avoid being hacked.