IoT Security Foundation launches co-ordinated vulnerability disclosure platform for industry

An online platform designed to help Internet of Things (IoT) vendors receive, assess, manage and mitigate vulnerability reports has been launched by the IoT Security Foundation (IoTSF). VulnerableThings.com aims to simplify the reporting and management of vulnerabilities whilst helping IoT vendors comply with new consumer IoT security standards and regulations.

As the first globally applicable standard for consumer IoT cybersecurity, the new ETSI EN 303 645 specification requires IoT vendors – which could include device manufacturers or importers/distributors – to publish a clear and transparent vulnerability disclosure policy; establish an internal vulnerability management procedure; make contact information for vulnerability reporting publicly available; and continually monitor for and identify security vulnerabilities within their products.

Governments around the world including in the UK, Australia, Singapore, Finland and the American states of California and Oregon have already published codes of practice, product labelling schemes or prepared legislation aligned to the standard. Implementing a means to accept vulnerability reports is a common feature of these initiatives. Without mechanisms to report, manage and resolve vulnerabilities – such as Co-ordinated Vulnerability Disclosure (CVD) – the security of consumer IoT products diminishes over time and the risk of attack or abuse increases.

“Vulnerability management is such a fundamental element to IoT cyber-hygiene that it is no surprise that governments and regulators around the world are making this a mandatory requirement,” says John Moor, managing director of the IoT Security Foundation.

“As a world authority on IoT security, IoTSF has published vulnerability disclosure best practices and industry status reports. Our conclusions are that industry must do more to protect their customers and their own businesses. We therefore see the need to drive this vital security practice and aim to help make it as simple as possible with the launch of the Vulnerable Things platform – especially for the uninitiated and firms who may lack resources. The service brokers good communications between researchers and vendors and guides both through the process until complete. We are piloting the service to test the likely demand and gain feedback for users,” Moor adds.

Vulnerabilities can put user safety and personal data at risk and could place an IoT vendor in breach of data protection regulations. Failure by a vendor to respond to a reported vulnerability, whether from a consumer or a specialist security researcher, could result in uncontrolled public disclosure of the vulnerability which would increase the risk of attacks by bad actors. Fixing a vulnerability promptly reduces risks to users, devices, networks and IoT manufacturers.

Matt Warman, the UK Government’s digital infrastructure minister comments: “I welcome this new initiative to help industry improve the security of internet of things devices and boost our burgeoning digital economy while protecting people online. We want everyone to have confidence that the internet-connected products they are buying have stronger security and are working on legislation in this field to help make this a reality.”

Matt Warman

VulnerableThings.com aims to provide an off-the-shelf, user-friendly vulnerability management tool and other valuable member resources including policy templates, issue resolution guidelines and a directory of specialist advisors to help IoT manufacturers prepare for emerging regulations and to maintain compliance. CVD must become an essential part of the culture of successful IoT vendors and needs to be understood and supported by a business’s board of directors, compliance officer, product managers, product development managers, product security, supply chain managers and public relations teams.

Manufacturers that subscribe to VulnerableThings will have access to a dashboard that will guide them through the vulnerability resolution process and facilitate communication with the reporter. Where a vulnerability is reported in a product from a vendor that hasn’t registered with the service, an alert will be sent to a public email address of the manufacturer who will then have the opportunity to securely access the details of the vulnerability report by coming to VulnerableThings.

Access to VulnerableThings.com is available free until January 31st, 2021. Subscribing to the service also provides access to professional support for co-ordinated disclosure announcements.

While vulnerabilities can be reported by any individual anonymously, by registering with VulnerableThings.com, security researchers are provided with a dashboard that allows them to monitor the progress towards resolving vulnerabilities they have reported to different manufacturers. Promoting dialogue between vendors and security researchers will contribute to the success of the IoT ecosystem.

Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

FEATURED IoT STORIES

9 IoT applications that will change everything

Posted on: September 1, 2021

Whether you are a future-minded CEO, tech-driven CEO or IT leader, you’ve come across the term IoT before. It’s often used alongside superlatives regarding how it will revolutionize the way you work, play, and live. But is it just another buzzword, or is it the as-promised technological holy grail? The truth is that Internet of

Read more

Which IoT Platform 2021? IoT Now Enterprise Buyers’ Guide

Posted on: August 30, 2021

There are several different parts in a complete IoT solution, all of which must work together to get the result needed, write IoT Now Enterprise Buyers’ Guide – Which IoT Platform 2021? authors Robin Duke-Woolley, the CEO and Bill Ingle, a senior analyst, at Beecham Research. Figure 1 shows these parts and, although not all

Read more

CAT-M1 vs NB-IoT – examining the real differences

Posted on: June 21, 2021

As industry players look to provide the next generation of IoT connectivity, two different standards have emerged under release 13 of 3GPP – CAT-M1 and NB-IoT.

Read more

IoT and home automation: What does the future hold?

Posted on: June 10, 2020

Once a dream, iot home automation is slowly but steadily becoming a part of daily lives around the world. In fact, it is believed that the global market for smart home automation will reach $40 billion by 2020.

Read more
RECENT ARTICLES

Scality’s 2022 forecast: Storage solutions get AI/MLOps upgrade, enhanced ransomware protection

Posted on: December 8, 2021

London, UK. 7 December 2021 – Scality announced its data storage predictions for 2022, coming off a year when ransomware attacks have exploded, skills shortages remain, and cloud adoption continues. This year’s forecast homes in on how storage solutions will evolve to meet these challenges and how emerging technologies will impact the data storage landscape.

Read more

Virtana free tier offering lets enterprises experience simplified hybrid cloud optimisation at no cost

Posted on: December 8, 2021

Virtana announced the immediate availability of a free version of Virtana Optimize, its cloud optimisation solution. The Free Tier offering complements the Premium version of Virtana Optimize, allowing for frictionless customer adoption.

Read more