The United Kingdom has decided to implement some new laws to strengthen security around the Internet of Things (IoT) and smart devices. According to the new laws, these devices will have to have certain features.
The aim of the new legislation is to protect UK users and businesses from cybercriminals who are increasingly targeting IoT devices.
Malicious hackers can exploit these devices to create a group of devices used to carry out DDoS. Also, IoT devices that are not adequately protected can give access to networks and other systems.
The Department for Culture, Media and Sport (DCMS) has worked with the National Cyber Security Centre (NCSC) and security experts, product manufacturers and retailers to make decisions about the new legislation.
"Our new law will allow companies that manufacture and sell such devices to address and thwart hackers who threaten people's privacy and security," said Minister Matt Warman.
Under the new legislation, IoT devices sold in the UK must have three characteristics. In a sense, they must follow three specific rules in order to be safe:
- All passwords for devices connected to the internet must be unique.
- IoT device manufacturers must provide a public “point of contact”so that users can report potential problems and vulnerabilities and have them addressed immediately.
- IoT device manufacturers should explicitly state the minimum period during which the device will receive security updates (either online or in-store).
However, we do not yet know when the new rules will be implemented. The government aims to introduce the legislation as soon as possible.
Currently, many devices arrive with simple, default passwords that in many cases cannot be changed. Additionally, some IoT product manufacturers do not offer users a way to contact them to report vulnerabilities.
Finally, many IoT products suddenly stop receiving updates from manufacturers, which means that after a while they are vulnerable to vulnerabilities.
If devices do not follow these rules, the new law will ban their sale in the UK.
The government had initially suggested that companies adopt some of these security practices, but had not made them mandatory. “The UK government had previously encouraged industry to adopt a voluntary approach, but it is now clear that decisive action is needed to ensure strong security is built into products,” Warman said.
The goal is to integrate security into the design of devices.
“Buyers will finally have peace of mind knowing that the technology they bring into their homes is secure and that issues like pre-set passwords and abrupt discontinuation of security updates are a thing of the past.”
