Can the Government’s Buying Power Create a More Secure Internet of Things?

Lawmakers believe by adopting cybersecurity standards for the internet-connected devices it purchases, the federal government can drive the tech industry into building safer and better-protected products for the internet of things.

“The internet of things presents an opportunity to improve and enhance nearly every aspect of our society, economy and day-to-day lives,” said Rep. Will Hurd, R-Texas, on Tuesday at a House Oversight and Government Reform Committee meeting. “But in order for us to be able to fully harness this technology, the internet of things needs to be built with security in mind, not as an afterthought.”

Gartner estimates that roughly 8.4 billion IoT devices are in use and the company expects that number to exceed 20 billion by the year 2020. The industry, however, lacks universal cybersecurity standards for the internet-connected devices it creates.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

Lawmakers believe this disparity in cybersecurity stems partly from a lack of market incentives for developing safe and secure products. Legislation in the Senate would require IoT devices to meet a number of basic cyber hygiene and security standards before federal agencies can purchase them. Because the government is such a big customer in this space, some lawmakers hope the bill will push companies to develop more secure products to win hefty federal contracts.

House lawmakers met with cybersecurity experts on Tuesday to discuss the state of IoT and outline some of the guidelines the industry should follow in securing their products.

Witnesses stressed device patching as one of the most important aspects of IoT cybersecurity. Many devices on the market lack the basic capability to have software and systems updated to close any exploitable security holes, said Ray O’Farrell, chief technology officer at VMware. A simple patching requirement would’ve completely eliminated the WannaCry malware attack that crippled hundreds of thousands of computers around the world, he noted.

“Unpatchable IoT is the lawn darts of the internet,” said Josh Corman, chief security officer for PTC. “They are inherently unsafe.”

Other recommendations included prohibiting devices that contain known vulnerabilities or ship with hard-coded passwords, ensuring products support multifactor authentication and favoring ones with multisegmentation fail-safes to defend against attacks. Witnesses applauded the bill for adopting many of the robust standards outlined by the National Institute of Science and Technology.

Witnesses also reiterated the idea that virtually every IoT device contains some type of vulnerability. What’s important is to create a framework that catches that vast majority of exploitable security holes and have a system in place to catch and fix vulnerabilities as they appear in the future.

The legislation serves as a solid first step toward building a more secure IoT ecosystem, but it only goes so far, said Corman. It doesn’t impose regulations on the tech industry, which ultimately has the final decision in the products it develops.

“While I really like some of the hygiene principles to lead by example, these have to be adopted by the private sector whether through self-regulation, purchasing or free market forces,” he said. “This bill alone won’t stop the next Mirai [botnet attack], but it could set an example for more devices to have higher hygiene.”