[Iot-directorate] vulnerability reporting -- hard to do!

[Michael Richardson <[e-mail]>]

https://www.iotsecurityfoundation.org/just-13-percent-of-consumer-iot-firms-allow-vulnerability-reporting-despite-incoming-laws-and-international-standards 

17th March 2020 – An analysis of 330 consumer IoT device manufacturers has revealed five of every six companies (86.7%, 286) don’t allow for vulnerability reporting. This would see them fall foul of new international standards and recently announced plans for a British IoT security law; as well as proposed Australian code of practice and recommendations from the US Dept of Homeland Security.

Vulnerability reporting enables vendors to be alerted to, and fix, cyber security weaknesses that could be exploited by hackers. It is widely considered to be a baseline requirement of IoT device security (Scroll down for international regulations and high-profile hacks).

Of the manufacturers that did allow vulnerability reporting, variations exist and many used a weakened policy, with more than a third (38.6%) indicating no timeline of disclosure.

European headquartered firms performed the worst among their cohort. Just 5 of the 82 companies based in the region (6.1%) comply with incoming standards and laws; this compares with 16.0% (23 of 144) of North American firms and 16.3% (16 of 98) of Asian developers.

Slight progress has been seen on 2018’s analysis, when less than 10% (32 of 330) implemented vulnerability reporting. The IoTSF report concludes “the industry must do better… much better”.

The study and analysis has been published by the IoT Security Foundation (IoTSF) and is its second annual report. As part of its remit to drive security best practice, the IoTSF is also calling for more collaboration between manufacturers and cybersecurity researchers.

....