The UK government today called for stronger security measures for internet-connected devices, urging manufacturers to build security into product designs.
The Department for Digital, Culture, Media & Sport (DCMS) is promoting a 13-point code of practice in its Secure by Design review, to encourage IoT vendors to make security part of the design process rather than bolting it on as an afterthought.
However, the report's guidelines are not compulsory, and the government said it plans to work with industry to embed cyber security practices into connected device design.
Minister for digital Margot James said: "We want everyone to benefit from the huge potential of internet-connected devices and it is important they are safe and have a positive impact on people's lives. We have worked alongside the industry to develop a tough new set of rules so strong security measures are built into everyday technology from the moment it is developed.
"This will help ensure that we have the right rules and frameworks in place to protect individuals and that the UK continues to be a world-leading, innovation-friendly digital economy."
The government estimates that each UK household has 10 internet-connected devices, a number that it predicts could increase to 15 by 2020, potentially posing serious data protection threats to UK citizens.
Ian Levy, technical director of the National Cyber Security Centre (NCSC), also highlighted a need for more clarity for consumers on the need to use secure IoT devices, and to remove the burden of installing complex security software from these end users.
"The NCSC is committed to ensuring the UK has the best security it can, and stop people being expected to make impossible safety judgements with no useful information," he said.
"We are pleased to have worked with DCMS on this vital review and hope its legacy will be a government 'kitemark' clearly explaining the security promises and effective lifespan of products."
"Shoppers should be given high quality information to make choices at the counter. We manage it with fat content of food and this is the start of doing the same for the cyber security of technology products."
Devices like smart wearables, webcams and even children's toys are at risk of hacking without proper security measures.
To prevent such incidents, the review's recommendations include ensuring that devices don't come with default passwords, which can be easily hacked, that vendors are able to regularly update products' software, and that they abide by a vulnerability disclosure policy and ensure their devices have built-in redundancy to prevent them from being overwhelmed by DDoS attacks.
The only binding requirement is to protect people's personal data, something that is a key element of the EU's incoming General Data Protection Regulation and the government's own Data Protection Bill.
As part of the review, the government explored current industry incentives and challenges to implementing cyber security in consumer IoT. The evidence suggested that the main obstacles centre around cost and the challenge of justifying investing time and money when a business's focus is to get its product to market as soon as possible.
Additionally, manufacturers are unlikely to face immediate economic costs borne by a DDoS attack conducted through their devices, and, therefore, would not face sufficient commercial incentives to invest in a secure-by-design approach.
The government said it will consider making the changes compulsory through law after reviewing IoT vendors' progress throughout 2018.
Picture: Shutterstock
