by Jeff Broth
The cyber threats on IoT are undeniable. The United States government, for one, points this out in its 2023 National Cybersecurity Strategy. However, it’s clear that there are efforts to hold off plans for compulsory IoT security. The US Federal Communications Commission (FCC), for example, has to settle with voluntary cybersecurity labeling IoT for now instead of making it mandatory as originally intended.
This seeming resistance to cybersecurity is not necessarily a refusal to be secure, though. Most organizations would want security for their IoT ecosystems. The problem is that they worry about their ability to comply with new regulations. New legal mandates can mean more costs for new technologies, people, and processes. These appear to complicate the logical movement towards security for IoT devices.
The basics of compliance
IoT cybersecurity can be summed up in four basic factors. These are data protection, access control, device authentication, and vulnerability management. Standards, regulations, and best practices largely revolve around these basic factors.
IoT devices should have adequate data security to make sure that sensitive information is not exposed to unauthorized access. There have to be robust access control mechanisms to prevent threat actors from physically or remotely taking over IoT device controls and configurations. Additionally, devices should be properly authenticated to ensure that only legitimate and safe devices connect to the network. Lastly, it is important to implement a sensible vulnerability management system to ascertain that security weaknesses are spotted before cybercriminals find and exploit them.
These factors may sound rudimentary, but many organizations are still unfamiliar with them, especially when it comes to applying them to the Internet of Things. Nevertheless, IoT cybersecurity compliance doesn’t have to be complicated; there are ways to streamline compliance without going through the conventional approach of software patching, which is usually time-consuming and tedious.
How to simplify cybersecurity compliance
Before anything, here’s an important clarification: In the context of existing and proposed regulations, IoT cybersecurity compliance is mostly the responsibility of device manufacturers. The IoT cybersecurity labeling program of the US FCC, for instance, is aimed at encouraging manufacturers to ascertain that the products they offer are safe and secure. The labels help consumers make informed IoT product purchase decisions. The labels serve as guides as to which devices are deemed safe and secure.
Presented below are points and suggestions on how IoT product makers can ensure the security of their devices in an efficient manner. This is not an exhaustive guide, but it covers the most important points in simplifying the complexities of IoT cybersecurity compliance.
1. Get acquainted with the applicable laws and regulations
Different Markets have different applicable regulations. For device manufacturers that seek to offer their products in the United States, for example, they have to be familiar with the IoT Cybersecurity Act of 2020. This law is quite clear and self-explanatory enough, so it should not be that difficult to comprehend its requirements.
However, if there are doubts about what the law mandates, it is advisable to work with security experts and the FCC itself. The government agency is more than willing to extend assistance to help organizations comply with regulations. It is important to emphasize, however, that the goal of compliance is to ensure IoT device security, not to merely comply and gain access to a specific market.
2. Implement industry standards and best practices
Many parts of existing regulations are derived from industry standards and cybersecurity best practices. Implementing these industry standards can already tick off many of the requirements of IoT cybersecurity regulations. The National Institute of Standards and Technology (NIST), for example, has comprehensive cybersecurity standards that include guidelines on keeping IoT devices secure.
When it comes to best practices, there are a number of security concepts that can be applied to IoT security. Some of the most important ones are as follows:
– Zero trust approach – Now becoming the new norm for cybersecurity, zero trust entails the optimization of security and minimization of risks by assuming that nothing is safe and nothing can be presumed harmless. As such, everything is required to go through security verification to ensure the security of identities, endpoints, applications, data, infrastructure, and networks. It is important to design IoT devices that constantly authenticate users and verify actions regardless of who the users are and how presumably safe a setup is.
– Secure by design – This is an approach in cybersecurity that integrates security throughout the entire development cycle of an IoT product. The secure by design concept calls for the embedding of multiple security mechanisms throughout the operation of a device to make sure that these mechanisms are consistently implemented and not ignored or arbitrarily deactivated.
– Security as code – Similar to secure by design, this cybersecurity discipline means that security is instilled into the DevOps tools and processes. As such, security is made an integral part of the code itself, which means that security controls are always active and may not be suspended or turned off.
– Continuous monitoring – IoT device manufacturers are expected to play an important role in the security of the devices they sell even if the products are already in the hands of buyers. This means that there is a need for post-market surveillance, preferably continuous monitoring. What’s good to know is that the rise of advanced AI makes continuous monitoring possible without having to shell out huge amounts for manual threat monitoring.
3. Use innovative tools
Just like AI, cybersecurity technologies have similarly advanced to help achieve IoT security without being too reliant on software patching, which can be costly and less than timely. There are solutions dubbed “security and observability platforms,” which are designed to provide runtime protection for IoT devices and deterministically stop exploit attempts.
These platforms plug the gaps in the usual software patching approach in conventional IoT cybersecurity. They secure individual IoT devices with real-time threat detection and continuous monitoring. They can operate without installing agent software, provide live alerts and detailed forensics, and enable security for isolated and gated devices.
These IoT cybersecurity solutions comprehensively address the threats affecting IoT devices, providing protection across the different phases of an IoT product’s lifecycle. They serve as a full-stack security platform for IoT device manufacturers, helping ensure IoT security compliance by ascertaining that security is taken into account all throughout the product life cycle.
Simplifying security and compliance
It’s understandable for many to regard IoT security as daunting and fraught with difficulties. However, the challenges are often overblown mainly because of the lack of knowledge and proficiency in securing modern connected devices. Everything can be simplified by gaining an adequate understanding of how to secure the Internet of Things, especially in the areas of data protection, access control, authentication, and vulnerability management. Also, there are advanced new cybersecurity solutions that make it considerably easier to secure IoT products by consolidating processes and streamlining compliance.
