As the original and lead author of the Code of Practice, I was really pleased to read the feedback and see that many other people feel the same way about improving the situation globally. I was able to discuss the feedback at length with colleagues from DCMS, the National Cyber Security Centre (NCSC) and other departments to ensure that we were creating a sensible measured set of guidance that took into account the needs and concerns of all stakeholders.
For further details on what the Code of Practice contains and why it exists, have a look at some of my previous blogs on this topic:
- A Code of Practice for Security in Consumer IoT Products and Services
- How the UK’s Code of Practice on IoT security would have prevented Mirai
- Consumers should be able to reject IoT products as not secure with these simple checks
A number of other documents are being released today, all of which are well worth a read if you're interested in this space.
Mapping Recommendations and Standards in the IoT security and privacy space
The thing that my team and I spent the most effort on over the summer period was mapping existing recommendations on IoT security and privacy from around the world against the Code of Practice. This was no mean feat and meant going through thousands of pages of pretty dry text. If you talk to anyone in the industry space, it is a job that everyone knew needed doing but nobody wanted to do it. Well I can say it is done now (thank you Ryan and Mark particularly!), but things like this are the never ending task. While we were working on it, new recommendations were being released and inevitably, just after we'd completed our work others were published. Equally, we ran the risk of mapping the entirety of the technical standards space. For now at least, we've stopped short of that and I think we've given implementers enough information such that they'll be able to understand what commonalities there are across different bodies and where to look. I still am sufficiently sane to state that I'll commit to keeping this updated, but we'll let the initial dataset be used by companies first. Ultimately I'm hoping this is the tool that will aid defragmentation in the IoT security standards space and again I'll continue to support this effort.
I'm really pleased that the government agreed with the suggestion that we should make the mappings available as open data. We've also created visual mappings just to make things a little more readable. All of this is hosted at https://iotsecuritymapping.uk which is now live.
|Mapping recommendations to the UK's Code of Practice for Consumer IoT Security|
Talking about the Code of Practice
I also continued to spend time discussing what we were doing with various security researchers and presented at both B-SidesLV in Las Vegas and at 44con in London. I also spoke to a number of different industry groups to explain what we were doing and what is happening next.
|Most IoT products v Skilled hackers|
No more. Change is here.