The US Federal Communications Commission has adopted a voluntary cybersecurity labelling program for wireless consumer Internet of Things products.
The program will enable qualifying consumer smart device manufacturers to demonstrate that their product has met the FCC's robust cybersecurity standards.
This includes a new 'US Cyber Trust Mark' logo, which consumers can scan for easy-to-understand security information relating to the product, such as the length of the support period and whether software patches and security updates are automatic.
The trust mark logo was announced by the Biden-Harris administration in July 2023.
The initiative is designed to help consumers factor cybersecurity into their purchasing decisions by differentiating safe products in the marketplace.
It is also hoped this will create market incentives for IoT manufacturers to enhance the security of their products.
IoT devices, such as home security cameras, fitness trackers and baby monitors, have been heavily targeted by cybercriminals in recent years.
They often provides a gateway to targeting businesses, with a recent study finding that 50% of companies have experienced IoT cyber incidents.
It is forecast that there will be more than 29 billion IoT devices in operation by 2030, which has put the issue of smart device security on the radar of governments.
The EU and UK have recently created legislation imposing minimum cybersecurity standards of smart device manufacturers.
The FCC will provide oversight of the program, with approved third-party label administrators managing activities such as evaluating production applications, authorizing use of the label and consumer education.
Accredited laboratories will handle manufacturers' compliance testing.
The FCC is also seeking public comment on additional disclosure requirements.
Future requirements could include whether the software or firmware for a product is developed or deployed by a company located in a country that presents national security concerns and whether customer data collected by the product will be sent to servers located in such a country.
Commenting on the announcement, Tim Mackey, head of software supply chain risk at the Synopsys Software Integrity Group, noted that the voluntary nature of the new program will mean it is unlikely there will be an influx of certified devices on store shelves or from online retailers.
This Cyber News was published on www.infosecurity-magazine.com. Publication date: Mon, 18 Mar 2024 15:50:04 +0000