It is estimated that the number of devices connected to the internet could reach 30 billion by 2020[1]. These connected devices include mobile phones, household appliances, smart watches, and even vehicles.
Despite our increasing reliance on connected devices, and the fact that they are ubiquitous in the consumer market, these devices pose significant cybersecurity risks. Often, connected devices are configured with factory-set passwords which cannot be changed and can be difficult or impossible to update or patch in the event of a virus or other security issue.
In an effort to address these risks, Senators recently introduced the Internet of Things (IoT) Cybersecurity Improvement Act of 2017, legislation designed to reduce cybersecurity risks in connected devices purchased by the United States government.
The requirements of the bill target specific vulnerabilities currently found in connected devices. For example, the bill requires contractors to verify that a certain connected device: (1) does not contain hardware, software, or firmware with any known vulnerability set forth by the National Institute of Standards and Technology (“NIST”); (2) relies on software components that are capable of accepting updates from a vendor; (3) uses only non-deprecated industry-standard protocols for certain functions; and (4) does not include hard-coded or fixed credentials for the delivery of communications or updates or for remote administration.
Perhaps most importantly, the bill requires prospective planning for security vulnerabilities related to connected devices. Contractors must promptly repair any new security vulnerability that is detected and provide the government with a timeline for ending security support associated with the connected device. These requirements are consistent with best practices in the IoT[2] space which require vendors to plan for security vulnerabilities throughout the entire lifecycle of a product.
In lieu of complying with the requirements of the bill, contactors may demonstrate that they comply with a third party security certification standard provided that standard imposes security obligations that are at least as restrictive as those of the bill. NIST would be responsible for developing accreditation standards for these third party certifiers.
The bill does include a waiver process in which the government can accept the risks associated with any connected device provided the contractor: (1) identifies the specific known vulnerability; (2) identifies any mechanisms for limiting or eliminating the possibility that the vulnerability will be exploited; and (3) provides a justification for secure use of the connected device in light of the identified vulnerability.
The bill is limited in scope in that it would only apply to those connected devices purchased by the United States government. Connected devices made generally available to the average consumer would not be subject to these requirements. However, the bill would require the government to maintain a publically accessible database of connected devices and manufacturers for which the government has received notice that security support will terminate. At a minimum, this database could provide consumers with information related to connected devices they own that may no longer be supported by the manufacturer.
The bill provides a baseline of minimum requirements government contractors must comply with in order to win government business. More generally, the bill serves as a good reminder to all vendors of connected devices to review current security controls and ensure these controls are in compliance with best practices set forth by NIST.
Previous blog posts that provide additional insight and guidance related to IoT security issues include Food and Drug Administration Issues Draft Guidance on Cybersecurity in Medical Devices (http://www.tuckerlaw.com/2016/02/02/food-and-drug-administration-issues-draft-guidance-on-cybersecurity-in-medical-devices/) and Best Practices For Implementing Internal Security Controls (http://www.tuckerlaw.com/2016/06/29/best-practices-implementing-internal-security-controls/).
For additional information contact Kristin Biedinger.
[1] http://www.mckinsey.com/industries/semiconductors/our-insights/the-internet-of-things-sizing-up-the-opportunity
[2] The Internet of Things or “IoT” is a term used to describe a network of interrelated devices. These devices rely on a combination of internet connectivity, sensors, and communication protocols to interact with each other.