Government take next step towards smart device security

They detail three elements manufacturers would have to consider, including the inclusion of unique passwords for each device.

The announcement follows a consultation which worked with experts to highlight security risks and challenges around smart devices and the Internet of Things (IoT).

Going forward, the Government will further develop their regulations before bringing them into force, although critics say the process isn't moving quickly enough.

Securing home devices

Under the proposals, manufacturers would need to ensure passwords for smart devices were unique and weren't able to be reset to universal settings.

There would also be a requirement for manufacturers to provide a public point of contact and to be explicit about the length of time each device will receive security updates.

The Government undertook a consultation with the National Cyber Security Centre, experts, manufacturers and retailers to work out the best way of labelling IoT devices, so customers know how secure their devices are at the point of purchase.

Consultation responses were mixed, with some respondents concerned about the negative implications for manufacturers of being forced to add labels to their products, while also suggesting customers could become complacent and overconfident about device security.

Importance of security

These proposals aren't new, and we previously discussed them back when the consultation was launched in May 2019.

However, progress is slow, and the consultation seems to have been one step on a long road towards improved security for smart home devices.

In the meantime, the Department for Digital, Culture, Media and Sport (DCMS) highlighted their research showing that consumers say security is the third most important factor when buying IoT devices. Only cost and functionality were registered as more important.

Among those who didn't rank it a top-four priority, though, there was an expectation from 72% of respondents that security is already effectively built into the device.

In their response to the consultation, DCMS concluded this leaves a huge gap between what consumers expect of their devices and the security they're actually capable of.

IoT security concerns

Concerns about smart home devices and the security of the IoT have been brewing for several years since smart technology began to embed itself into our homes.

A strategy assembled by Ofcom back in 2015 covered network security, pointing out there were already provisions in the Communications Act 2003 to force companies to keep publicly available networks and services secure.

At the same time, though, respondents to their consultation argued existing regulations should be strengthened rather than new ones being developed, and Ofcom pledged to explore their own role in the area of IoT security.

Network providers have also been working to address the security issues raised by the IoT, with BT launching an ethical hacking service in 2015 to seek out vulnerable points in cars connected to the network.

In 2017, Vodafone followed O2 by launching V, a range of smart devices and an app-based system to allow customers to monitor those devices.

Their range included a car dongle, one for cats and dogs, home security cameras and a dongle to keep track of bags and briefcases. As of today, the range also includes SOS bands aimed at the elderly and trackers for kids.

Other providers have also launched their own devices and plans, with EE allowing customers to add smart home devices to their plans since 2018.