IoT vendors urged to ditch devices' default passwords and improve security

UK government review outlines measures to protect consumers from IoT threats

The UK government today called for stronger security measures for internet-connected devices, urging manufacturers to build security into product designs.

The Department for Digital, Culture, Media & Sport (DCMS) is promoting a 13-point code of practice in its Secure by Design review, to encourage IoT vendors to make security part of the design process rather than bolting it on as an afterthought.

However, the report's guidelines are not compulsory, and the government said it plans to work with industry to embed cyber security practices into connected device design.

Minister for digital Margot James said: "We want everyone to benefit from the huge potential of internet-connected devices and it is important they are safe and have a positive impact on people's lives. We have worked alongside the industry to develop a tough new set of rules so strong security measures are built into everyday technology from the moment it is developed.

"This will help ensure that we have the right rules and frameworks in place to protect individuals and that the UK continues to be a world-leading, innovation-friendly digital economy."

The government estimates that each UK household has 10 internet-connected devices, a number that it predicts could increase to 15 by 2020, potentially posing serious data protection threats to UK citizens.

Ian Levy, technical director of the National Cyber Security Centre (NCSC), also highlighted a need for more clarity for consumers on the need to use secure IoT devices, and to remove the burden of installing complex security software from these end users.

"The NCSC is committed to ensuring the UK has the best security it can, and stop people being expected to make impossible safety judgements with no useful information," he said.

"We are pleased to have worked with DCMS on this vital review and hope its legacy will be a government 'kitemark' clearly explaining the security promises and effective lifespan of products."

"Shoppers should be given high quality information to make choices at the counter. We manage it with fat content of food and this is the start of doing the same for the cyber security of technology products."

Devices like smart wearables, webcams and even children's toys are at risk of hacking without proper security measures.

To prevent such incidents, the review's recommendations include ensuring that devices don't come with default passwords, which can be easily hacked, that vendors are able to regularly update products' software, and that they abide by a vulnerability disclosure policy and ensure their devices have built-in redundancy to prevent them from being overwhelmed by DDoS attacks.

The only binding requirement is to protect people's personal data, something that is a key element of the EU's incoming General Data Protection Regulation and the government's own Data Protection Bill

As part of the review, the government explored current industry incentives and challenges to implementing cyber security in consumer IoT. The evidence suggested that the main obstacles centre around cost and the challenge of justifying investing time and money when a business's focus is to get its product to market as soon as possible.

Additionally, manufacturers are unlikely to face immediate economic costs borne by a DDoS attack conducted through their devices, and, therefore, would not face sufficient commercial incentives to invest in a secure-by-design approach.

The government said it will consider making the changes compulsory through law after reviewing IoT vendors' progress throughout 2018.

Picture: Shutterstock

Featured Resources

BIOS security: The next frontier for endpoint protection

Today’s threats upend traditional security measures

Download now

The role of modern storage in a multi-cloud future

Research exploring the impact of modern storage in defining cloud success

Download now

Enterprise data protection: A four-step plan

An interactive buyers’ guide and checklist

Download now

The total economic impact of Adobe Sign

Cost savings and business benefits enabled by Adobe Sign

Download now

Recommended

The Ritz suffers data breach after hackers pose as staff
data breaches

The Ritz suffers data breach after hackers pose as staff

17 Aug 2020
Russia hacked Liam Fox's personal email to steal trade documents
phishing

Russia hacked Liam Fox's personal email to steal trade documents

4 Aug 2020
British teenager charged over Twitter hack
hacking

British teenager charged over Twitter hack

3 Aug 2020
Mid-year report says vulnerabilities up 22% in 2020
hacking

Mid-year report says vulnerabilities up 22% in 2020

30 Jul 2020

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
Google removes 17 apps infected with evasive ‘Joker’ malware
malware

Google removes 17 apps infected with evasive ‘Joker’ malware

28 Sep 2020