Dive Brief:

• The Federal Communications Commission voted to create a long-anticipated U.S. Cyber Trust Mark program that will provide a label for smart products on the consumer market that meet robust cybersecurity standards. 
• The voluntary program will allow makers of Internet of Things products — ranging from home security cameras to baby monitors and internet-connected appliances — to submit their products for testing and evaluation under third-party administrators.  
• The FCC will seek public comment on additional proposed disclosure requirements, including whether certain software and firmware is made in countries that pose a security risk to the U.S.

Dive Insight:

The U.S. Cyber Trust Mark program is considered a key component of the Biden administration’s national cybersecurity strategy. 

The administration has taken numerous steps in recent years to strengthen the nation’s cyber resilience following the 2020 supply chain attacks linked to state-sponsored hackers and the 2021 ransomware attack against Colonial Pipeline.  

Connected technologies are widely used by consumers and businesses, with some third party estimates showing more than 25 billion devices will be in use by 2030, according to the FCC. The FCC also cited third-party data indicating more than 1.5 billion attacks took place against IoT products during the first six months of 2021.

“Our expectation is that over time more companies will use the Cyber Trust Mark — and more consumers will demand it,” FCC Chair Jessica Rosenworcel said in a statement Thursday. “This has the power to become the worldwide standard for secure Internet of Things devices.” 

The program approval arrives during a period of increased concerns about IoT security, as threat groups like Volt Typhoon have exploited vulnerabilities in edge devices in a larger campaign to potentially spread destructive attacks against critical infrastructure providers in the U.S.

Federal authorities in January disrupted KV Botnet, in which hackers put malware onto hundreds of small office/home office routers. 

Some experts remain skeptical about whether a voluntary program will have enough teeth to truly create incentives to move the needle on consumer device security. 

“We have seen this with other voluntary guidance across critical infrastructure,” Patrick Gillespie, OT lead at GuidePoint Security, said via email. “Without distinct requirements being imposed on manufacturers, the security of IoT devices will remain as they are today — insecure.”