11

Is there any reliable certificate for IoT devices, which can be used to compare the provided security of these devices?1

Currently, the IoT landscape is completely scattered with different protocols, standards and proprietary solutions. On the other hand IoT devices fall to botnets like flies. Is there any standard out there which customers can put their trust in for the device to comply to a certain level of security? Maybe even a certificate vouching for the provided security?

If there is no current standard, are there promising initiatives to create such a standard?


1: Disclaimer: This is based on this Area 51 question from a user who seemingly did not commit to the site in commitment stage. I want to post it to help define the scope of the site.

11

UL (formerly Underwriters Laboratories) provide the Cybersecurity Assurance Program to certify that an Internet of Things device is, in their opinion, secure from most major threats.

UL seem to be highly respected in their certification processes, according to Ars Technica:

UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification.

UL describe their certification as involving:

  • Fuzz testing of products to identify zero day vulnerabilities over all interfaces
  • Evaluation of known vulnerabilities on products that have not been patched using the Common Vulnerability Enumerations (CVE) scheme
  • Identification of known malware on products
  • Static source code analysis for software weaknesses identified by Common Weakness Enumerations (CWE)
  • Static binary analysis for software weaknesses identified by Common Weakness Enumerations (CWE), open source software and third party libraries
  • Specific security controls identified for use in products that reduce the security risk [...]
  • Structured penetration testing of products based on flaws identified in other tests
  • Risk assessment of product security mitigation designed into products.

However, the exact process in which UL scrutinise devices is unclear (unless you pay to buy the full set of specifications), as Ars Technica note (and criticise):

When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

Although UL are respected, we cannot assume that their certification is particularly sound in terms of security without further scrutiny, though it does satisfy the original question.

Unfortunately, I couldn't find any open standards/certifications for security, though this is likely because the resources required would be far too large for a non-profit association.

| improve this answer | |
3

I want to add to Aurora0001's answer that we can only protect against known threats.

Recently, we've seen the Spectre and Meltdown attacks against hardware. Whilst Intel CPU's are not commonly used in IoT devices, we will probably find security problems with IoT hardware in the future. Previously we've seen Rowhammer and Heartbleed, as general system-class bugs, affecting huge numbers of system. As IoT grows, I believe it will be more common-place to see such vulnerabilities.

So I would focus less on security certifications, and more about:

  • Openness, so that third parties can evaluate the software.
  • Stated support lifetimes, where the manufacturer guarantees security updates
  • Upgradeability, including automatic upgrades as default setting.

If a device is stated to be under support for a long time, and defaults to auto-updating the software when new releases occurs, the impact of security problems will be reduced. Certification will only tell you that there was no known security bugs when the product was shipped.

| improve this answer | |
  • Heartbleed may be a system-class bug from a system deployment point of view, but it's still a bug in a specific piece of software that just needs to be upgraded. Better examples would be attack on the protocol itself, such as BEAST and CRIME. – Gilles 'SO- stop being evil' Jan 14 '18 at 22:47
  • The point is that bugs can be found in unlikely places (CPUs), and in well known software (Heartbleed), thus we need patching and updating of software. But yes - there is a plethora of bugs to choose from. – vidarlo Jan 15 '18 at 5:56
  • Certifications could very well include support life-times or the ability for firmware updates—even openness. So while you're correct that those are very important points I don't quite see why they are incompatible with certifications in general. – Helmar Jan 15 '18 at 8:48
  • 2
    @Helmar Unfortunately, serious certifications are pretty much inherently a heavyweight process. Certifying the initial version and the update process is one thing, but certifying each update before it's deployed adds a significant overhead, which makes it difficult to establish a good certification process (where security updates would have to be certified after the fact — which goes against the grain of certification, since it means the device will run non-certified versions). – Gilles 'SO- stop being evil' Jan 15 '18 at 19:01
  • @Gilles I agree one could only certify the quality processes of the software development or something like that. Certifying every software version is not really an option. – Helmar Jan 18 '18 at 21:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.