Secure by Design Code of Practice: Why it is important
Code outlines guidelines that manufacturers of consumer IoT devices should implement into their product’s design to keep consumers safe.
We’ve all heard the stats before. By 2020, over 12bn consumer devices will be internet connected. From your smart meter to your smart TV, these Internet of Things (IoT) devices can bring a range of benefits to consumers such as greater user experience and lower costs.
Concerns, however, have been raised about the poor security inherent within some of the connected consumer devices currently on the market and the lack of incentives for manufacturers to build security into the devices from the outset. Some of this is down to the lack of awareness amongst consumers of security weaknesses when buying devices, whilst others have argued that the multitude of standards and guidelines out there have made things too complicated for those creating IoT products and services.
That is why we at techUK were so keen to support the Department for Digital, Culture, Media and Sport (DCMS) in its ‘Secure by Design’ review, since it sought to address these problems by:
- Creating a Code of Practice for manufacturers of consumer IoT products and services
- Mapping guidelines in the Code of Practice to existing UK and international recommendations and standards
- Issuing consumer guidance on smart devices in the home
The publication of the Code of Practice is a watershed moment for the UK IoT and cyber security community. Developed in consultation with experts in government, industry and academia, the Code of Practice outlines thirteen guidelines that manufacturers of consumer IoT should implement into their product’s design to keep consumers safe and secure, ranging from the removal of default passwords to keeping software updated.
What has been refreshing about the development of the Code of Practice has been the enthusiasm from a range of stakeholders to get this right. From manufacturers and retailers to consumer groups and trade bodies, there has been agreement that we have to move the burden of responsibility for ensuring the security of the devices away from the consumer to one where strong cyber security is built into consumer IoT products by design and consumers can easily set up and manage a device in a secure manner.
The Government has also sought to make it easier for manufacturers to implement the Code by publishing a mapping document which links the thirteen guidelines to existing standards, recommendations and guidance on IoT security and privacy from around the world, representing one of the largest collections of guidance on IoT security and privacy to date.
A key aspect to the Code’s success will be through the international efforts that the Government undertakes, ensuring that guidelines from the Code drive global alignment across the IoT supply chain. Government can also help move the market towards a secure by design approach by ensuring that government departments purchase devices from suppliers that are adopting, or working towards adopting, the Code in a similar way that Cyber Essentials is now slowly being mandated across suppliers to local and central government.
The next step in the process is, of course, getting manufacturers to commit to implementing the Code and giving advice and guidance to consumers in order for them to set up and manage their devices in a secure manner. techUK will be continue supporting the Code, and working with its members as to strengthen consumer trust in the security of IoT products and services.
techUK’s CEO, Julian David, recently said “The Internet of Things (IoT) can benefit consumers by providing them with greater insight and control over their lifestyles. But citizens still have justified concerns about the level of security in IoT devices and we must address these if the IoT is ever to reach its full potential.
“We are pleased to have worked with Government and security experts to develop this Code of Practice and related documents as part of its Secure by Design Project. These offer companies a baseline to build on as they design their products and services with security front of mind. While it might take time for companies to fully align to all of the commitments, working towards achieving this will help strengthen consumer trust in the security of IoT”.
Latest News from
How Greater Manchester is putting residents at the heart of digital innovations07/05/2021 16:05:00
Guest blog: Phil Swan, GMCA Digital Director as part of our #DigitalPlace week.
Adopting a citizen led approach to reinventing service delivery through artificial intelligence and robotics07/05/2021 13:05:00
Guest blog: Elizabeth Ajayi – Liz is PwC Consulting CoE lead for intelligent automation in the UK. She also leads PwC’s local public sector Intelligent Automation team which is currently supporting multiple council’s across the UK with their automation journey.
The power of big data in understanding & shaping community development07/05/2021 09:05:00
Guest blog by Dr Jamie Samson, Head of Data Science and Insights, MindFolio on how the public sector can leverage the power of big data.
X marks the spot - or does it?06/05/2021 16:25:00
Guest blog: Kate Lindley, Service Lead for Digital and Data at Socitm Advisory as part of our #DigitalPlace week.
Digital tools for collaborative net zero placemaking06/05/2021 13:05:00
Guest blog: Natalie Record, Housing Lead at Connected Places Catapult on the critical role of systems thinking and digital tools to deliver net zero places.
Using technology, data and insight to create a new customer experience across local government06/05/2021 10:20:00
Guest blog: Simon Freeman, Managing Director for Capita Local Public Services, and Chris Melia, Capita’s Customer Experience Director for Local Public Services, discuss the challenges that local government has faced during the Coronavirus pandemic. As part of our #DigitalPlace week.
techUK welcomes the announcement of a new Enhanced Trade Partnership between the UK and India06/05/2021 09:05:00
techUK welcomes the announcement of a new Enhanced Trade Partnership -with digital being one of its key priorities – intending to begin work towards a UK-India Free Trade Agreement and enhanced collaboration in our industry.
PDS launches Social Media Management & Engagement Framework05/05/2021 16:10:00
The Police Digital Service (PDS) has launched a Social Media Management & Engagement Framework for policing, blue light services and local authorities, paving the way for increased consistency in service delivery to the public, with potential for a central triage point for all public interaction.
Worried about doing business in China? Perhaps "PPE" is the answer05/05/2021 14:20:00
China’s Q1 Data shows economic recovery