A new security bill is awaiting signature by President Trump. It directs the National Institute of Standards and Technology (NIST) to create minimum cybersecurity standards for IoT devices owned or controlled by the U.S. government. The standards will include use and management of IoT devices, as well as coordinated disclosure of vulnerabilities.
Let’s take a look at how the security bill will benefit organizations that use IoT devices.
A new bill that could significantly advance IoT security awaits signature by the U.S. President. It directs NIST to create minimum cybersecurity standards for IoT devices owned or controlled by the U.S. government.
The lack of security standards has been an issue since IoT devices became popular a decade ago, with their widespread usage outpacing the industry’s ability to agree on how to protect them.
The failure to agree hasn’t been for lack of trying. For the last few years, several industry and government groups created standards to improve interoperability and security of IoT devices, including:
In spite of these groups’ efforts, there hasn’t been sufficient incentive for the industry to align around a single set of standards. The result has been a patchwork of guidelines that address only some aspects of IoT device security.
For example, the European Union Agency for Cybersecurity (ENISA) performed a gap analysis on the existing standards related to IoT security and found that “…it is possible to deliver a device to the market that can authenticate its user, that can encrypt data it transmits, that can decrypt data it receives, that can deliver or verify the proof of integrity, but which will still be insecure.”
The current lack of standards on IoT vulnerability reporting and handling means that vendors aren’t under any obligation to disclose or remediate vulnerabilities, leaving millions of vulnerable devices at risk of exploit.
This new effort will likely succeed where previous industry efforts have failed, because it’s being carried out on behalf of a customer with very deep pockets – the U.S. government. Although the bill only applies to devices purchased or managed by the government, its purchasing power will provide a powerful incentive for manufacturers to adopt the standards.
Additionally, the U.S. Congress failed to pass two IoT cybersecurity bills in the last session. This bill shifted the focus to the establishment of standards by NIST and gained approval by both the House and Senate.
The IoT device security bill calls out four particular areas for the creation of standards and guidelines to manage cybersecurity risks:
It also directs NIST to work with the U.S. Department of Homeland Security, along with “cybersecurity researchers and private-sector industry experts” to publish guidelines for reporting and remediating vulnerabilities. The guidelines will also need to align with “industry best practices” and widely adopted IT standards ISO 29147 (vulnerability disclosure) and 30111 (vulnerability handling).
If you’re curious about NIST’s Cybersecurity for IoT Program, you can review the related standards and provide feedback on proposed standards here.
All that remains for the IoT device security bill to become law is for the U.S President to sign it. The U.S. Senate unanimously passed it in late November (I admit that I found it hard to believe that this august body could collectively agree on a topic as complex as IoT security standards, but that’s a conversation for another day) after the U.S. House of Representatives passed an identical bill earlier this year.
Here are three examples of risks that IoT devices present in OT environments:
Malware: As highlighted in the OT/IoT Security Report webinar, the Nozomi Networks Labs team identified several strains of malware that targeted IoT devices in the first half of 2020, including the Mirai and Dark Nexus botnets. Bad actors are finding success with malware thanks to:
Vulnerabilities: Palo Alto Networks’ Unit 42 reported that “57% of IoT devices are vulnerable to medium- or high-severity attacks, making IoT the low-hanging fruit for attackers.”
Common Mistakes: OWASP created the OWASP IoT Top 10. It lists the top ten things to avoid when building, deploying, or managing IoT systems, highlighting common mistakes that organizations make when deploying IoT devices.
In spite of the lack of standards, you can reduce the risks related to IoT devices in your industrial environment by using proven OT/IoT visibility and security tools.
In spite of the lack of standards, you can still reduce the risks posed by IoT devices in your environment.
Find a visibility and security solution that enables you to:
The industrial strength Nozomi Networks security solution, including Guardian and our Central Management Console, can help. It combines asset discovery, network visualization, vulnerability assessment, risk monitoring and threat detection in a single solution.
Looking further ahead, the volume of IoT devices expected to be deployed in the next few years will likely overwhelm any on-premises monitoring technology and disrupt your ability to secure your network. Nozomi Networks’ new Vantage product can help you address that challenge as well. It leverages the power of SaaS, scaling to protect any number of devices in any number of locations, with a single application.
While the hard work of developing device standards hasn’t been completed, and the bill hasn’t yet been signed into law, this development is a major step forward for IoT security. NIST has been adopted by thousands of organizations, not just in the U.S., but worldwide. A global adoption of IoT device security standards will go a long way towards improving overall industrial and critical infrastructure security.
If you’d like to discuss the implications of the new IoT device security bill, please let us know.
Related Content
Rising IoT Botnets and Shifting Ransomware Escalate Enterprise Risk
2020 1H
Find out about:
Related Links
The post The U.S. Government is Creating Security Standards for IoT Devices appeared first on Nozomi Networks.
*** This is a Security Bloggers Network syndicated blog from Nozomi Networks authored by Patrick Bedwell. Read the original post at: https://www.nozominetworks.com/blog/the-u-s-government-is-creating-security-standards-for-iot-devices/
When it comes to detecting phishing and social engineering threats, slow response times are detrimental. Automate online brand protection to take…
Interesting development in Germany to restore phonetics that were erased by the Nazis Before the Nazi dictatorship some Jewish names…
Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization's…
via the comic delivery system monikered Randall Munroe resident at XKCD! Permalink
Many thanks to DEF CON and Conference Speakers for publishing their outstanding presentations; of which, originally appeared at the organization's…
It's December, so you know what that means: Predictions for what's to come for cyber in 2021. We brought together…