The Biden administration is unveiling a new cybersecurity label for smart devices today. In a press conference, Federal Communications Commission (FCC) chair Jessica Rosenworcel said the new label, called the US Cyber Trust Mark, will mean that devices bearing it meet security standards based on those established in a report from the National Institute of Standards and Technology (NIST). The voluntary program is expected to be in effect in 2024, with the labels appearing on the devices “soon after.”
The program is for connected devices commonly found in the home, such as smart refrigerators, smart microwaves, smart televisions, and smart climate control systems. But the announcement also lists “smart fitness trackers” as a device that would fall under the certification and labeling program, suggesting ambitions beyond the smart home. It has the voluntary support of several electronics, appliance and consumer products manufacturers, retailers and trade associations, including Google, Samsung, Logitech, Amazon, Best Buy and the Connectivity Standards Alliance (home of the Matter smart home standard).
The FCC “acts among its authorities to regulate wireless communications devices” to propose the certification and labeling program, which, according to a press release, would require “strong default passwords, data protection, software updates and incident detection capabilities.” Rosenworcel compared it to Energy Star, which stands for products such as computers or appliances that meet certain energy efficiency standards.
The Cyber Trust label consists of two parts: a logo stamped on a product’s box and a QR code that buyers can later scan to verify that the device is still certified as cybersecurity threats evolve and patches are needed are. In an interview with Deputy National Security Adviser Anne Neuberger, I wondered if the QR code would be used to give people more detailed security information about a product, such as whether a product needs a constant internet connection to work. Neuberger reiterated that the QR code helps customers stay informed and encourages such ideas through public comments when the time comes.
A senior FCC official said during the Q&A session after the briefing that the Commission is considering annual recertifications, but the intervals have not yet been set. As for who will handle the certification, Neuberger said it would fall to third-party labs like the Connectivity Standards Alliance or the Consumer Technology Association.
Neuberger said the label is needed to “incentivize the market to build safer products through design,” and said companies that can distinguish themselves with such a label could make them more comfortable with the increased cost of better products. security.
She also said the program will encourage accountability as smart home products must continue to release security patches as needed to maintain their Cyber Trust label. Neuberger said in an interview with The edge that there will always be “another zero day”, calling it “tricky” that sometimes when the intelligence community discloses an IoT vulnerability to companies, they say they are done with those products and will not release a patch.
During the interview, Neuberger pointed to the NIST report when asked what the FCC will consider an “IoT product” under the Cyber Trust labeling program. Essentially, according to the NIST, any network-connected device with a “sensor or actuator” can be considered an “IoT device,” while the entirety of that device — its companion app, cloud backend, and required custom hubs – is considered the “IoT product.”
However, individual network devices such as Zigbee and Z-Wave hubs that are not tied to one device are instead lumped together with Wi-Fi routers, which were not examined as part of the report. The NIST defines the cybersecurity requirements of consumer-grade routers as a priority given the risks they pose to eavesdropping, password theft, and other nefarious activities in targeted homes. It expects to complete this work by the end of 2023 so that the Commission can consider router cybersecurity requirements for inclusion in the labeling programme.
The Biden administration is expected to unveil the new Cyber Trust logo later today with a live stream from the White House from 9:30 a.m. to 11 a.m. ET, revealing more details about the program and which companies have already committed to it .
So far, the government lists the following “participants” in support of today’s announcement:
Amazon, Best Buy, Carnegie Mellow University, CyLab, Cisco Systems, Connectivity Standards Alliance, Consumer Reports, Consumer Technology Association, Google, Infineon, Information Technology Industry Council, IoXT, KeySight, LG Electronics USA, Logitech, OpenPolicy, Qorvo, Qualcomm , Samsung, UL Solutions, Yale and August US
