Cybersecurity

Why agencies must work harder to prep for IOT security

Shutterstock image (by a-image): connected devices around the world.

Government agencies tasked with regulatory and security responsibilities are running out of time to address security challenges associated with the increased connectivity of the Internet of Things, according to Department of Homeland Security Assistant Secretary for Cyber Policy Robert Silvers.

Increased connectivity for devices means expanded attack surfaces. The challenge, Silvers said at an Aug. 31 National Institute of Standards and Technology meeting, is developing flexible, living security standards while preserving the innovation and productivity gains that come with increased internet.

"I think we all recognize the IoT is not a trend, it's a full-blown phenomenon at this point," he said. "We have, as against that enormous security challenge, a very narrow and closing window in which to address the security challenges on the front end before we are put in the much more difficult, much less enviable position of addressing security against an ecosystem that is already stood up, functioning and created."

Trying to bolt on security measures after the widespread proliferation of connected devices "is suboptimal… if not impossible, is more expensive and is less effective than doing it right to start," he said.

Silvers also lamented the current lack of "anything resembling a standard of due care" for when things "really go awry and ultimately hit the court system" in cases that may negatively impact consumers.

"I think we need just to be very candid with ourselves, with each other, that we see few solutions gaining traction in any kind of holistic and sustained and widespread way," he said.  "The bottom line is that product is moving to market without security" plans for either the short or long term, he said.

Silvers acknowledged that there are "very good efforts" in the public and private sectors to protect IoT stakeholders, such as NIST's IoT building blocks and the Defense Department's investment in IoT security.

However, he also emphasized that government agencies, including DHS, "need to work a lot harder" on the IoT security front.  "We need to accelerate everything we're doing," he said. "We need to make tough decisions now because they're not going to get easier."

For long-term solutions, Silvers said he was unsure of the best answer, but suggested a system of certification like the Energy Star seal of approval for home appliances as a potential avenue.

"In the meantime, we need to have bridge solutions," he said.

Silvers also announced that although DHS is not a regulatory agency, it is planning to issue strategic principles for IOT stakeholders, including best practices and guidance for risk-based decisions that draw from previous work of private partners and other agencies.

He said the principles will not be overly prescriptive or controversial, but that "it's time" for agencies to begin to address their security responsibilities.

About the Author

Chase Gunter is a staff writer covering civilian agencies, workforce issues, health IT, open data and innovation.

Prior to joining FCW, Gunter reported for the C-Ville Weekly in Charlottesville, Va., and served as a college sports beat writer for the South Boston (Va.) News and Record. He started at FCW as an editorial fellow before joining the team full-time as a reporter.

Gunter is a graduate of the University of Virginia, where his emphases were English, history and media studies.

Click here for previous articles by Gunter, or connect with him on Twitter: @WChaseGunter

Featured

  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.