UK Government calls for feedback on regulation of IoT device security

August 14, 2020

Following the UK Government’s announcement in January 2020 that it would be moving forwards with regulation on consumer IoT device security, the Government has now published its legislative proposals and is seeking feedback from interested parties by 6 September 2020.

The Government’s proposals impose new requirements on manufacturers for the manufacture and sale of consumer smart devices, and also introduce the appointment of a new designated body to oversee compliance and enforcement.

What do you need to know?

The proposed legislation sets out three baseline security requirements, which are derived from and align with several of the key provisions in the recently launched standard ETSI EN 303 645:

A ban on default passwords: universal default usernames and passwords installed by manufacturers (such as “admin” or “123456”) are to be banned. Passwords should be ‘unique per device’ or user defined and should not revert to a factory setting.

The implementation of a robust method of vulnerability reporting: manufacturers should prepare a clear and transparent vulnerability disclosure policy, publish contact information for the reporting of flaws or vulnerabilities with IoT device security, and provide a high-level indication of expected timescales for responses. This should be supplemented by a defined and coordinated process across all levels of the supply chain for the reporting of and response to such issues.

Transparency of software updates: the minimum length of time during which IoT devices will be supported by security updates should be provided to consumers in an accessible, clear and transparent manner, and disclosed at or before the point of sale.

UK Government calls for feedback on regulation of IoT device security

UK Government set to move forwards with regulation on consumer IoT device security

Residential Landlords: Don’t Fall Foul of Right to Rent!

Latest Post

More Posts