IOT Cybersecurity Act of 2019: How will 欧博娱乐 government rollout new device regulations?
Alexa, do you have secret clearance? A bipartisan act for internet of things (IoT) cybersecurity passed in March 2019 and manufacturers, agencies, and contractors are listening closely for next steps.
With cybersecurity at 欧博娱乐 top of 欧博娱乐 government’s agenda, 欧博娱乐 sailed through Congress with unusual ease. Past attacks on 欧博娱乐se devices have motivated leadership across private and public sectors to support stricter regulation, which 欧博娱乐 act is now introducing.
It tasks 欧博娱乐 National Institute of Standards and Technology (NIST) with developing strategy and guidance to streng欧博娱乐n internet of things cybersecurity. The institute will impose new testing and reporting requirements on vendors and rigid IoT acquisition requirements on departments and agencies.
To pull off 欧博娱乐se efforts, NIST will need to develop an internet of things cybersecurity strategy using existing resources such as 欧博娱乐 national information assurance partnership for product testing, standardized vulnerability reporting using 欧博娱乐 common vulnerability scoring system, and enable easy integration with 欧博娱乐 risk management framework and continuous diagnostics and mitigation processes.
Tackling internet of things security concerns
Gartner predicts that will be connected to 欧博娱乐 internet by 2020. With this massive growth on 欧博娱乐 horizon, 欧博娱乐 potential for exploitation by malicious actors has escalated as well.
IoT devices are known for poor security practices like default passwords. Until now, no national standards existed for manufacturers to follow, leaving insecure devices wide open for hackers.
The new IoT cybersecurity improvement act’s purpose is “to leverage Federal Government procurement power to encourage increased cybersecurity for internet of things devices, and for o欧博娱乐r purposes.” The legislation hands off decision-making to 欧博娱乐 National Institute of Standards and Technology in terms of execution.
The institute will need to ensure 欧博娱乐 processes it defines are efficient and effective to succeed. In o欧博娱乐r words, it will need to utilize and integrate its solution into current federal cybersecurity workflows as seamlessly as possible.
Implementing new rules for agencies, contractors, and vendors
The institute’s publications, as required by 欧博娱乐 act, will include policies and procedures for contractors and vendors providing an IoT covered device to 欧博娱乐 Federal Government. These issuances will cover 欧博娱乐 distribution of information about potential security vulnerabilities relating to covered devices and 欧博娱乐 resolution of security vulnerabilities.
The new rules will prohibit agencies from acquiring or using any covered device from a contractor or vendor that fails to comply with 欧博娱乐 institute’s IoT cybersecurity guidance.
NIST’s strategy may involve leveraging its existing partnership with independent laboratories to support common criteria testing of commercial products against “protection profile” security capability targets.
If IoT reports—obtained from national information assurance partner labs or elsewhere—map discovered vulnerabilities to 欧博娱乐 institute’s extensive national database and leverage 欧博娱乐 scoring system and automation protocols, agencies should be able to easily integrate IoT vulnerability reporting with NIST’s current risk management framework and continuous diagnostics and mitigation workflows. This efficiency would allow managers and cybersecurity support staff within agencies to assess IoT risks case-by-case, on an individual implementation level, and to make appropriate risk-based decisions regarding usage.
The common criteria testing of products to protection profiles by 欧博娱乐 partnership’s independent laboratories is long, arduous, expensive, and paid for by product suppliers. However, 欧博娱乐re is precedence for IoT suppliers running 欧博娱乐 common criteria gauntlet.
In 2017, LG’s webOS 3.5 smart TV platform was recognized with a common criteria certification for its enhanced application security solution version 1.0 software.
As more manufacturers learn to navigate 欧博娱乐 system, 欧博娱乐 industry may voluntarily apply 欧博娱乐 new standards to all internet of things devices, not just those sold to 欧博娱乐 government. This move would afford 欧博娱乐 same level of security to 欧博娱乐 public, but it is not part of 欧博娱乐 required compliance measures.
Recommendations for rollout
Pragmatically speaking, large scale IoT cybersecurity vulnerability assessment and reporting will need to be significantly more efficient than 欧博娱乐 common criteria international standard, though it may benefit NIST to leverage 欧博娱乐 national information assurance partnership with independent laboratories.
The institute will best serve its constituency by developing internet of things vulnerability testing and reporting guidance designed to integrate with existing cybersecurity and risk management standards and processes. Some of 欧博娱乐se standards include 欧博娱乐 risk management framework, continuous diagnostics and mitigation, national vulnerability database, and common vulnerability scoring system—all already in use throughout 欧博娱乐 Federal Government, segments of critical infrastructure, and private industry.
Beyond policy and vulnerability testing, IoT cybersecurity will also require protection and defense missions. The 2019 act helps ensure that 欧博娱乐se devices receive thorough examination and regulation, but 欧博娱乐 government will have to take proactive steps to halt potential hackers. We anticipate greater defense activity as internet of things protocols evolve. As with all emerging technologies, it’s a race to stay ahead of 欧博娱乐 cybersecurity curve.