Despite all the excitement generated by the rise of the Internet of Things (IoT), the one major concern lurking in the background has been that of security. The frightening prospect of securing every single IoT device has lead to more than a fair share of headaches for IT personnel. A quick glance at how the IoT is being developed shows that the security worries are more than justified. After all, the number of items and devices that will be connected to the internet will likely reach the tens of billions before the end of the decade. That means a whole host of items looking to take advantage of the new technology while simultaneously dismissing security needs. The lack of any universal security standards for the IoT also remains a pressing problem. Luckily, a number of organizations are trying to remedy this issue with new IoT security certifications.
One of the more recent major announcement regarding security certification for IoT devices comes from Underwriters Laboratories (UL). The organization is calling it their Cybersecurity Assurance Program, or CAP for short. The basic idea is to test new IoT devices for any security vulnerabilities along with whether it includes data encryption, software updates, and authentication measures. The idea is to ensure any IoT device used by individuals or businesses has the right systems in place to fight off cyber attackers. This is especially important to companies since a single IoT device that is breached could render an entire network vulnerable.
ULs CAP is expected to release its first certifications in the third quarter of this year. The certification process currently has three levels. The first is the most basic, where UL simply tests products to see if they can defend against certain types of cyber attacks. The second level of certification adds more tests designed around controls for industrial and healthcare sectors, which for obvious reasons carry greater demands for security and compliance. The third level goes even further, investigating the process of product development to see if it can hold up to security standards too.
But Underwriters Laboratories isnt the only organization working on IoT security certification. ICSA Labs also announced a program intended to boost security for IoT devices and systems. Their IoT Certification Testing program will look at six different components found in most IoT devices including communications, physical security, and alert/logging. The organization says it has been part of the cyber security community for nearly three decades, making it uniquely qualified to tackle the significant challenge of IoT security as the Internet of Things becomes more prominent and mainstream.
Beyond those organizations, the Internet of Things Security Foundation (IoTSF), a non-profit body aiming to improve IoT security practices, is also working to develop a self-certification method for IoT product developers. The complexity of the security situation and accompanying big data challenges make the need for these organizations a must.
As helpful and welcome as these developments are, security certifications may only be scratching the surface of what the IoT needs. The entire Internet of Things ecosystem will need proper security testing, from the third-party products being developed to the cloud infrastructure that many of these products rely on. Theres also the question of how effective security certifications will be in the first place. With the frequency of patches for software and IoT devices, some certifications may become outdated, especially as new methods of cyber attacks surface. Some experts believe that security certifications should be removable if products later prove unable to handle the new security demands needed over time.
If anything can be learned from the push for better IoT security certification, its that this development is needed but isnt the cure-all many hope for. More work needs to be done to make the IoT safe for everyone. A lot of data will be at risk once the Internet of Things hits its peak, so getting a solid start now will avoid a lot of pain in the future. Though security certifications may not solve every problem, its one step that must be taken for people to feel more secure once more devices and objects become connected to the web.
