A new law is in the pipeline to strengthen the security requirements for consumer internet of things (IoT) devices.
Announced by the Department of Digital, Culture, Media and Sport (DCMS) and the National Cyber Security Centre (NCSC), it will lay down three prime requirements:
-
All consumer internet connected device passwords must be unique and not resettable to any universal factory setting.
-
Manufacturers must provide a public point of contact for reporting vulnerabilities.
-
Manufactures must explicitly state the minimum length of time for which the device will receive security updates at the point of sale.
Digital Minister Matt Warman (pictured) said: “We want to make the UK the safest place to be online with pro-innovation regulation that breeds confidence in modern technology.
“Our new law will hold firms manufacturing and selling internet connected devices to account and stop hackers threatening people’s privacy and safety. It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”
DCMS said it wants to the deliver the relevant legislation as soon as possible.
While focused on consumer devices, the legislation is likely to be relevant to the increasing use of assistive IoT technology in the care sector.
Image by Chris McAndrew, CC BY 3.0