Feature: Consumer electronics


Standards are key to reducing the risk of consumer IoT attacks


By Alex Leadbeater, TC CYBER Chair, ETSI W


ith over 500 billion devices expected to be linked to the Internet by 2030, the


world is seeing connections being made to everyday items that 30 years ago would have never been imagined. Whether devices such as children’s toys and baby monitors, smoke detectors, door locks, smart TVs and speakers, home appliances like washing machines, refrigerators and many more are added to the connected list, globally, every day. However, this proliferation of connected IoT devices also means the risk landscape for potential cybersecurity attacks is widening, too.


Standards to tackle threats Cyberattacks occur every 40 seconds, so it has never been more important for manufacturers to protect their consumer IoT products. To begin with, manufacturers need better understanding and guidance in how to manage the security of their devices, keeping homes and businesses safe from cyberattacks. Regulatory bodies and government organisations worldwide are aware of these


24 October 2022 www.electronicsworld.co.uk


dangers and are responding with regulations and standards. ETSI EN 303 465 is the world-adopted


consumer IoT standard that establishes a common baseline globally, raising the security bar to a good level. Compliance with the standard restricts the ability of attackers to control devices across the globe – known as botnets – to launch distributed denial of service (DDoS) attacks, mine cryptocurrency and spy on users in their own homes. By preventing such attacks, the EN represents a huge upliſt in baseline security and privacy through its high-level base recommendations.


Cyber security provisions Whilst there is a strong global adoption of IoT solutions, some 43% of businesses still don’t fully protect themselves; this is an alarming figure. ETSI’s EN 303 645 thirteen outcome-


focused guidelines are widely considered good practice in IoT security, but the top three provisions, listed here, are considered the most basic first point of defence against cyberattacks. Some countries introduce equivalent


standards, which users are strongly advised to adhere to, and some are even being written into law. In the UK the government is set to announce legislation surrounding these three base provisions, with top advisers from the Department for Digital Culture, Media and Sport stating that if all manufacturers had implemented these provisions, then all the major breakneck botnet attacks would not have occurred. Tis implementation we are witnessing


around the globe emphasises the need for IoT device manufacturers to adopt a security- first approach to bolster protection, not just for themselves and the technical ecosystem, but for the end users, too. Te biggest risks for businesses and


consumers are poor credential management, poor vulnerability processes and not updating soſtware. Terefore, ETSI EN 303 645 sets the following top three provisions for basic IoT device security:


1. No universal default standards Many consumer IoT devices are sold with universal default usernames and passwords for user interfaces through to network protocols. Tese are the source of many


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40