The UK government is offering a £400,000 fund to anyone that can develop assurance schemes that boost the security of IoT products.
The programme, announced by the Department for Culture, Media and Sport (DCMS), aims to build more trust in internet-connected products and find ways to show a device has gone through independent and robust testing before reaching consumers.
It follows on from the government's IoT code of practice, 'Secure by Design', that it launched in 2018. If the fund is successful, it would mean manufacturers would have a choice of schemes to test their products. It would also allow retailers to ensure they are stocking secure IoT devices and help inform customer purchase decisions, the government claims.
The sale of connected devices has been rising for a number of years, with more and more household items becoming 'smart'. According to IDC research, there will be 75 billion internet-connected devices in the world by 2025. The hope is that the scheme will empower consumers to make more detailed choices with their IoT devices with each one having a security seal of approval.
"We are committed to making the UK the safest place to be online and are developing laws to make sure robust security standards for consumer internet-connected products are built in from the start," said Digital Minister Matt Warman.
"This new funding will allow shoppers to be sure the products they are buying have better cyber security and help retailers be confident they are stocking secure smart products. People should continue to change default passwords on their smart devices and regularly update software to help protect themselves from cyber criminals."
The government is also progressing legislation for a minimum security requirement for smart tech. The proposed law, which was announced at the start of the year, requires that all consumer IoT devices adhere to three security criteria. They must have unique passwords – not resettable to any universal factory setting. All manufacturers must also provide a public point of contact so anyone can report an issue, and they must also state the minimum length of time for which their device will receive security updates.
