After recently announcing its plans to develop IoT security guidelines, the U.S. Department of Homeland Security (DHS) just released its Strategic Principles for Securing the Internet of Things.
The guidelines come after a series of IoT-related cyberattacks in the U.S.
and other countries. These attacks came in the form of an attacker hacking and gaining control of more than a million network-connected devices to form the largest ‘Botnets’ in history,
which were then controlled to target and disrupt servers.
“The growing dependency on network-connected technologies is outpacing the means to secure them,” said Jeh Johnson,
secretary of Homeland Security.
“Securing the Internet of Things has become a matter of homeland security. The guidance we issued today is an important step in equipping companies
with useful information so they can make informed security decisions.”
What has been noted by many security professionals, as well as DHS, is that most of the compromised IoT devices
were accessed by using the manufacturer’s default username and password, not complex hacking.
As a result, one of the suggested practices by DHS is to ‘enable security by default
though unique, hard to crack default usernames and passwords.’
Pointing to this area of security vulnerability in the context of the recent Botnet attacks, DHS urges that strong security
in IoT devices should not require additional action to turn on, but instead should require intentional additional action to be disabled.
Here are the principles set out by DHS for securing the
Internet of Things:
- Incorporate security at the design phase
- Advance security updates and vulnerability management
- Build on proven security practices
- Prioritize measures according to potential impact
- Promote transparency across the Internet of Things
- Connect carefully and deliberately
These guidelines,
however, are just that. They are not legally required, but are intended more to be used as suggested practices for IoT product developers and manufacturers, service providers and industrial and
business-level consumers, according to DHS.
“We have a rapidly closing window to ensure security is accounted for at the front end of the Internet of Things phenomenon,” said
Robert Silvers, assistant secretary for cyber policy.
“These principles will initiate longer-term collaboration between government and industry.”