Is there a certificate to indicate the security level of IoT devices?

Question

Is there any reliable certificate for IoT devices, which can be used to compare the provided security of these devices?¹

Currently, the IoT landscape is completely scattered with different protocols, standards and proprietary solutions. On the other hand IoT devices fall to botnets like flies. Is there any standard out there which customers can put their trust in for the device to comply to a certain level of security? Maybe even a certificate vouching for the provided security?

If there is no current standard, are there promising initiatives to create such a standard?

---

_{1: Disclaimer: This is based on this Area 51 question from a user who seemingly did not commit to the site in commitment stage. I want to post it to help define the scope of the site.}

Answer 1

UL (formerly Underwriters Laboratories) provide the Cybersecurity Assurance Program to certify that an Internet of Things device is, in their opinion, secure from most major threats.

UL seem to be highly respected in their certification processes, according to Ars Technica:

UL, the 122-year-old safety standards organisation whose various marks (UL, ENEC, etc.) certify minimum safety standards in fields as diverse as electrical wiring, cleaning products, and even dietary supplements, is now tackling the cybersecurity of Internet of Things (IoT) devices with its new UL 2900 certification.

UL describe their certification as involving:

• Fuzz testing of products to identify zero day vulnerabilities over all interfaces
• Evaluation of known vulnerabilities on products that have not been patched using the Common Vulnerability Enumerations (CVE) scheme
• Identification of known malware on products
• Static source code analysis for software weaknesses identified by Common Weakness Enumerations (CWE)
• Static binary analysis for software weaknesses identified by Common Weakness Enumerations (CWE), open source software and third party libraries
• Specific security controls identified for use in products that reduce the security risk [...]
• Structured penetration testing of products based on flaws identified in other tests
• Risk assessment of product security mitigation designed into products.

However, the exact process in which UL scrutinise devices is unclear (unless you pay to buy the full set of specifications), as Ars Technica note (and criticise):

When Ars requested a copy of the UL 2900 docs to take a closer look at the standard, UL (formerly known as Underwriters Laboratories) declined, indicating that if we wished to purchase a copy—retail price, around £600/$800 for the full set—we were welcome to do so. Independent security researchers are also, we must assume, welcome to become UL retail customers.

Although UL are respected, we cannot assume that their certification is particularly sound in terms of security without further scrutiny, though it does satisfy the original question.

Unfortunately, I couldn't find any open standards/certifications for security, though this is likely because the resources required would be far too large for a non-profit association.

Answer 2

I want to add to Aurora0001's answer that we can only protect against known threats.

Recently, we've seen the Spectre and Meltdown attacks against hardware. Whilst Intel CPU's are not commonly used in IoT devices, we will probably find security problems with IoT hardware in the future. Previously we've seen Rowhammer and Heartbleed, as general system-class bugs, affecting huge numbers of system. As IoT grows, I believe it will be more common-place to see such vulnerabilities.

So I would focus less on security certifications, and more about:

• Openness, so that third parties can evaluate the software.
• Stated support lifetimes, where the manufacturer guarantees security updates
• Upgradeability, including automatic upgrades as default setting.

If a device is stated to be under support for a long time, and defaults to auto-updating the software when new releases occurs, the impact of security problems will be reduced. Certification will only tell you that there was no known security bugs when the product was shipped.