IoT vendors urged to ditch devices' default passwords and improve security

UK government review outlines measures to protect consumers from IoT threats

The UK government today called for stronger security measures for internet-connected devices, urging manufacturers to build security into product designs.

The Department for Digital, Culture, Media & Sport (DCMS) is promoting a 13-point code of practice in its Secure by Design review, to encourage IoT vendors to make security part of the design process rather than bolting it on as an afterthought.

Advertisement - Article continues below

However, the report's guidelines are not compulsory, and the government said it plans to work with industry to embed cyber security practices into connected device design.

Minister for digital Margot James said: "We want everyone to benefit from the huge potential of internet-connected devices and it is important they are safe and have a positive impact on people's lives. We have worked alongside the industry to develop a tough new set of rules so strong security measures are built into everyday technology from the moment it is developed.

"This will help ensure that we have the right rules and frameworks in place to protect individuals and that the UK continues to be a world-leading, innovation-friendly digital economy."

The government estimates that each UK household has 10 internet-connected devices, a number that it predicts could increase to 15 by 2020, potentially posing serious data protection threats to UK citizens.

Advertisement - Article continues below

Ian Levy, technical director of the National Cyber Security Centre (NCSC), also highlighted a need for more clarity for consumers on the need to use secure IoT devices, and to remove the burden of installing complex security software from these end users.

Advertisement - Article continues below

"The NCSC is committed to ensuring the UK has the best security it can, and stop people being expected to make impossible safety judgements with no useful information," he said.

"We are pleased to have worked with DCMS on this vital review and hope its legacy will be a government 'kitemark' clearly explaining the security promises and effective lifespan of products."

"Shoppers should be given high quality information to make choices at the counter. We manage it with fat content of food and this is the start of doing the same for the cyber security of technology products."

Devices like smart wearables, webcams and even children's toys are at risk of hacking without proper security measures.

To prevent such incidents, the review's recommendations include ensuring that devices don't come with default passwords, which can be easily hacked, that vendors are able to regularly update products' software, and that they abide by a vulnerability disclosure policy and ensure their devices have built-in redundancy to prevent them from being overwhelmed by DDoS attacks.

Advertisement - Article continues below

The only binding requirement is to protect people's personal data, something that is a key element of the EU's incoming General Data Protection Regulation and the government's own Data Protection Bill

As part of the review, the government explored current industry incentives and challenges to implementing cyber security in consumer IoT. The evidence suggested that the main obstacles centre around cost and the challenge of justifying investing time and money when a business's focus is to get its product to market as soon as possible.

Additionally, manufacturers are unlikely to face immediate economic costs borne by a DDoS attack conducted through their devices, and, therefore, would not face sufficient commercial incentives to invest in a secure-by-design approach.

The government said it will consider making the changes compulsory through law after reviewing IoT vendors' progress throughout 2018.

Picture: Shutterstock

Featured Resources

Preparing for long-term remote working after COVID-19

Learn how to safely and securely enable your remote workforce

Download now

Cloud vs on-premise storage: What’s right for you?

Key considerations driving document storage decisions for businesses

Download now

Staying ahead of the game in the world of data

Create successful marketing campaigns by understanding your customers better

Download now

Transforming productivity

Solutions that facilitate work at full speed

Download now


ethical hacking

Mobile banking apps are exposing user data to attackers

26 Jun 2020

Most malware came through HTTPS connections in Q1 2020

25 Jun 2020

Phishing attacks target unsuspecting Wells Fargo customers

24 Jun 2020

Trump administration wants to enhance the security of .gov sites

24 Jun 2020

Most Popular

Google Android

Over two dozen Android apps found stealing user data

7 Jul 2020

How to find RAM speed, size and type

24 Jun 2020

The road to recovery

30 Jun 2020