Government moves to ban weak default passwords on IoT devices

DCMS proposes a trio of security requirements that shore up millions of smart home gadgets

The government has revealed plans to ensure that all consumer smart devices in the UK adhere to a trio of rigorous security requirements. 

Drawn up by the Department for Digital, Culture, Media and Sport (DCMS), the plans require that all “consumer internet-connected devices” have a unique password that cannot be reset to any universal factory setting.

The plans also require the manufacturers of Internet of Things (IoT) devices to provide a point of contact to which anyone can report a security vulnerability they discover, and to ensure that security problems are “acted on in a timely manner”. 

The third security requirement would require IoT device manufacturers to explicitly state a minimum length of time from the point of sale, be it online or offline, that a device will receive security updates from the vendor. 

Related Resource

Strengthen your defences against cybercrime

Cyber resilience planning for email

Download now

The plans appear motivated by research that suggests there will be 75 billion internet-connected devices across the world by 2025, which present a large attack surface for cyber criminals to target if the security of devices such as smart televisions, cameras, and smart home assistants, isn’t up to scratch. 

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Digital Minister Matt Warman noted that the plans are aimed at keeping the UK safe but also not stand in the way of technology innovation.

“We want to make the UK the safest place to be online with pro-innovation regulation that breeds confidence in modern technology,” said Warman. “Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety. 

“It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”

The government had been keen to champion security in smart home and other IoT devices, having launched its Secure by Design code of practice for consumer IoT security in 2018. While this served as a means to advocate for stronger cyber security practices for internet-connected devices, it was a voluntary scheme.

The plans would appear to take the code of practice further, with legislation to be the means of ensuring that IoT device makers don’t bypass best-practice security standards.

Featured Resources

Digital Risk Report 2020

A global view into the impact of digital transformation on risk and security management

Download now

6 ways your business could suffer if you don’t backup Office 365

Office 365 makes it easy to lose valuable data regularly, unpredictably, unintentionally, and for good

Download now

Get the best out of your workforce

7 steps to unleashing their true potential with robotic process automation

Download now

8 digital best practices for IT professionals

Don't leave anything to chance when going digital

Download now
Advertisement

Most Popular

Visit/mobile/28299/how-to-use-chromecast-without-wi-fi
Mobile

How to use Chromecast without Wi-Fi

5 Feb 2020
Visit/operating-systems/27717/how-to-fix-a-stuck-windows-10-update
operating systems

How to fix a stuck Windows 10 update

12 Feb 2020
Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

10 Feb 2020
Visit/software/linux/354831/microsoft-to-add-defender-antivirus-software-to-linux-ios-and-android
Linux

Microsoft to add Defender antivirus software to Linux, iOS and Android

21 Feb 2020