IoT Security Foundation Launches Responsible Discloser Online Platform

The IoT Security Foundation (IoTSF) is proposing a new online platform that would help IoT vendors to receive, assess, manage and mitigate vulnerability reports.

The ETSI EN 303 645 is a new standard that’s being enforced in Europe, and it’s directly aimed at IoT hardware manufacturers. The new standard underpins several security features that companies have to build into their devices, which, in turn, would make them compliant with the standard.

One of the most critical security aspects of any IoT device is how manufacturers deal with vulnerabilities. Unfortunately, the IoT ecosystem doesn’t put a high price on vulnerability disclosure, let alone fixing them. A recent study revealed that many commercial routers have to wait for an average of one year of a patch.

The governments of the UK, Australia, Singapore, Finland and the American states of California and Oregon already took the first steps in the same direction. They published guides and labeling scheme to help manufacturers mark their products accordingly and consumers to make informed purchases.

“Vulnerabilities can put user safety and personal data at risk and could place an IoT vendor in breach of data protection regulations,” says IoTSF.

“Failure by a vendor to respond to a reported vulnerability, whether from a consumer or a specialist security researcher, could result in uncontrolled public disclosure of the vulnerability which would increase the risk of attacks by bad actors. Fixing a vulnerability promptly reduces risks to users, devices, networks and IoT manufacturers.”

The new online platform is available at VulnerableThings.com, offering tools and resources such as policy templates, issue resolution guidelines, and a directory of specialist advisors.

Also, security researchers can use the platform to report vulnerabilities for vendors that aren’t registered, in which case, the system automatically sends a message to the manufacturer’s public email address. It’s also possible to submit vulnerabilities anonymously.