Cloud Security Alliance issues IoT security guide

The Cloud Security Alliance, a nonprofit organization that pioneered security benchmarking and certification for cloud computing, has issued technical guidance for designers and developers of Internet of Things devices. But a starting point is all they offer.

The Cloud Security Alliance, a nonprofit organization that pioneered security benchmarking and certification for cloud computing, has issued technical guidance for designers and developers of Internet of Things devices.

“It is often heard in our industry that securing IoT products and systems is an insurmountable effort,” said Brian Russell, chairman of the alliance’s IoT Working Group in a statement. “However, with the help of our extremely knowledgeable and dedicated volunteers, we are providing a strong starting point for organizations that have begun transforming their existing products into IoT-enabled devices, as well as newly emerging IoT startups.”

But a starting point is all they offer.

“Nothing that is connected is completely secure,” the authors acknowledge. “For the purposes of this document, we define a secure IoT device as a device that implements sufficient security measures such that an attacker will move onto another target.”

A series of recent huge distributed denial-of-service attacks using large botnets made up of compromised IoT devices have demonstrated the plethora of targets available for hackers. The devices were easy to break into at scale because they ship with default passwords hardcoded into their firmware.

“We’re in this huge rush to connect right now,” said John Grimm, from Thales e-Security, an encryption vendor. “There are going to be consequences, especially when so many of these devices are built without any thought for security.”

IoT product developers should start with five foundational security engineering practices, the guide states. They should make sure they have a secure means to update firmware and software on the devices; use encryption and authentication procedures in product interfaces and on the mobile applications and gateways that connect with them; and “implement a secure root of trust” for encryption keys on the device.

Oh, and they should get an independent security assessment of their products.

In addition to these recommendations, the guide includes a discussion on IoT device security challenges; the results of a survey about IoT security; a discussion on security options available for IoT development platforms; and a detailed checklist for security engineers to follow during the development process.

Russell, who is also Leidos’ chief engineer for cybersecurity solutions, said the guide aimed “to empower developers and organizations with the ability to create a security strategy that will help mitigate the most pressing threats to both consumer and business IoT products.”

Nearly 30 expert CSA members worked on the 80-plus page guidance report, published Friday.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure