UK to mandate IoT security-by-design in upcoming legislation

Just as it’s about to leave the European Union, the United Kingdom has announced plans to deliver new legislation that aims to strengthen the security of connected smart products in Europe.

The UK government first hinted at the upcoming regulation in 2018, when it put forth a document outlining the Secure by Design Code of Practice for consumer IoT security. The document was intended to help vendors ensure hackers can’t easily compromise their products.

Digital Minister Matt Warman announced this week that a new law is being prepared based on the security-by-design principle, which includes three main security requirements for the Internet of Things (IoT):

• All consumer internet-connected device passwords must be unique and not resettable to any universal factory setting
• Manufacturers of consumer IoT devices must provide a public point of contact so anyone can report a vulnerability and it will be acted on in a timely manner
• Manufacturers of consumer IoT devices must state, either in store or online, how long the device will receive security updates at the point of sale

“We want to make the UK the safest place to be online with pro-innovation regulation that breeds confidence in modern technology,” Digital Minister Matt Warman said. “Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety. It will mean robust security standards are built in from the design stage and not bolted on as an afterthought.”

The plans, which set a new standard for best practice requirements for IoT vendors, were drawn up by the Department for Digital, Culture, Media and Sport (DCMS) in conjunction with the business industry and the National Cyber Security Centre.

The UK government plans ongoing discussions with all parties involved to keep improving the legislation even after it goes into effect. No deadline was given, with the UK government only saying it “aims to deliver this legislation as soon as possible.”