The video critiques the United States’ effort, led by NIST, to create cybersecurity labels for Internet of Things (IoT) devices. The speaker acknowledges the appeal of labeling but argues that industry‑driven or overly complex schemes will fail to inform consumers or drive better security. He surveys three existing approaches – Carnegie Mellon’s CyLab detailed attribute matrix, Singapore’s four‑star self‑declaration system, and Symantec’s checklist‑style rating – and finds each either too intricate or too simplistic for the average buyer. He then proposes an independent rating model that combines simple star/colour icons with a handful of core criteria (basic hardening, compromise resistance, exposure risk, privacy, vendor trust). Independent verification, especially for vendor‑trust scores, would be required, akin to Underwriters Laboratories for electronics. The speaker stresses that clear, consumer‑friendly labels are essential to motivate manufacturers, prevent IoT devices from being hijacked into botnets, and avoid a wasted regulatory effort.
Chapters
The United States is exploring the idea to establish cybersecurity labels for Internet of Things devices and software in hopes it will both inform consumers of risks and motivate manufacturers to improve the security for the flood of new products entering the market. Now, IoT devices number in the billions. Some estimates are as high as 46 billion for this year alone and continue to emerge at a quickening pace, yet they are often weak when it comes to being hacked, uh, creating growing risks to consumers' privacy, security, and now even safety. The U.S. has indicated a desire to adopt some kind of labeling and has kicked off discussions with manufacturers and industry experts. The National Institute of Standards and Technology, NIST, within the U.S. Department of Commerce is leading this particular effort, and NIST has opened up input to the public and is encouraging participation by manufacturers. Now, I'm somewhat skeptical of what the manufacturing industry will recommend or voluntarily implement when it comes to cybersecurity labels for IoT devices. The core problem is that the industry itself is not putting forth the necessary effort to implement even basic cybersecurity functionality into their product architecture and design processes. This group is now being asked to develop a label standard to help consumers. I expect the results to be less than stellar. Zeller. On the upside though, I do applaud the creative concept of security labeling as an out-of-the-box idea, and especially in, in involving the private sector. But this path, it does have significant weaknesses when it comes to how the relevant content of the disclosures will be decided. And the challenges for a meaningful absorption by the consumer. Now, there are many efforts by security, overseas governments, and the academic organizations that are involved in IoT, and many show promise, but they also have challenges. Let's dive into a few examples. The first one here is from Carnegie Mellon University. It's their CyLabs group, and these men and women are really sharp. I worked with them many years ago when I was with Intel on crisis response teams, CERT teams, on cybersecurity metrics and industry best practices, a whole bunch of different things including insider threats and, and different taxonomies. They're really smart. And what they've come up with, as you can kind of see here, is highly detailed. This is what I would expect from these geniuses, right? They are identifying a whole bunch of different attributes and quantifying them and marking them and putting additional links. But this is way too complicated to understand for the average consumer. Great amount of detail and insight here, but it is just simply far too complex to understand. Now, the next example here actually comes out of Singapore, and Singapore is a thought leader when it comes to protecting their economy, infrastructure, major organizations from cyber threats, both internal and external. And they really kind of have the capability to unify and set forth regulations that can be enforced unilaterally. So they kind of have an advantage here. And what they've come up with is a very simplistic, um, kind of labeling system where— here, where you've got a number of different levels, 1 through 4 stars, if you will. And these different stars represent tiers. And one of the interesting things here is if an organization is going to kind of self-declare, well, they can only do that for certain areas of these, and others they can't. It requires independent testing to be able to get kind of to the higher stars and, and to be able to cover for some of these areas. Now, I think this does strike a balance between independent verification and self-reporting, but overall it's really too simplistic to convey a meaningful risk picture again to the consumers to understand what really is at risk for them. If we look at the third example here, and this is from Symantec, which is a cybersecurity organization, and again it's kind of a scaled-down version of what CyLab proposes, but the data doesn't readily translate into something meaningful to the average consumer. You've got a lot of checkboxes, you've got a lot of terminology for the industry, you know, firmware versus password versus, you know, access or encryption, and, and what is it capturing? Great data, meaningful to some users and some consumers, but for the vast majority, it probably comes up short in being able to be easily understood for them to make good business decisions. Now, personally, I would rather have the effort into developing an independent rating scale that gives simple scores for compliance to basic hardening configurations, resistance to compromise, exposure risk to other systems, privacy, and trust of the vendor. Kind of some basic things. And I've just mocked this up really quick, but again, it's a combination of stars and colors, and it covers just a handful of basic areas that people should understand. And, you know, marry this with a little bit of description Well, that might resonate with the audience and be able to convey some of the most important elements that they should be considering. And it should also highlight some of those areas that the manufacturers really need to focus on. And this could support the economics of self-reporting, but with limited scores for some of the categories. And additionally, we would require an approved independent body to do the ratings for some of the categories. For example, uh, Vendor Trust right? You can't self-report that. You would need an independent body to do that, kind of like Underwriter's Laboratory does with electronics. If we do have a trusted source for that, then we can kind of— well, we can kind of balance that self-reporting with the trustworthiness of an independent organization. Overall, I the results really must be presented in simple icons for consumers with perhaps, again, some plain English that highlights the most important results. Now, if we're making that a requirement, that straightforwardness, simplicity, maybe some analysis and grading done in the background by professionals, but presenting something simple to the consumer? Well, that should encourage competitiveness by the vendors to deliver meaningful security for IoT products. Label information really must be clear and meaningful to convey the risks to consumers. To make sure that the ratings are consistent and not manipulated, we would have independent verification, and that has to occur at a minimum in some areas. For anything maybe over a 2-star rating or something like that. And I also caution letting the IoT manufacturing industry take the lead for any type of labeling decisions. And the concern there is it may not be easily comprehended by consumers, or it might be overly simplistic that barely scratches the aspects necessary to understand the relevance of security for the device or for the software. IoT devices are easily compromised, unfortunately, and if they're used against— IoT devices are easily compromised and then either used against the owner or are herded into botnets that can attack other systems on the internet. Cybercriminals and hackers realize the vast number of unsecured IoT devices as an excellent resource to leverage in pursuit of their goals. If we're going to go down this path of security labeling, we must do it correctly for it to become a catalyst of enhanced security for these products. A rational system must be proposed where clear goals are defined and benefit consumers. Otherwise, it's a wasted effort and an unfortunate delay in addressing the systemic problem of IoT security.
