[Iot-directorate] consumer IoT Standard EN 303 645 update

[Michael Richardson <[e-mail]>]

from IoTSF:

EN 303 645 is currently going through NSOs (National Standards Organisations)
for voting - the voting deadline is June 9th - public draft is available at:
https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.00_30/en_303645v020100v.pdf

IoTSF has supported this work since inception and we have sent a letter of
support as part of the official process.

For those unfamiliar with prior work, the objectives of EN 303 645 / TS 103
645 were as follows:

1. Bring together widely considered good practice in security for consumer
IoT devices in a set of high-level, outcome-focused provisions. Focus on
technical controls and organisational policies that matter most in addressing
the most significant and widespread security shortcomings.

2. Consider a baseline level of security, to protect against elementary
attacks on fundamental design weaknesses. (That means a focus should be on
protecting against scenarios involving automatic remote attacks
(e.g. botnets), rather than sophisticated targeted attacks requiring physical
access to the device.)

3. Avoid creating an unacceptable burden for small businesses.

4. Take into account that innovation is progressing rapidly in this space and
build in flexibility where possible

5. Provisions must be appropriate for the full spectrum of “consumer IoT”.

What else?
• DCMS will present an update on the status of this at the forthcoming
  plenary on Jul 8th (see calendar IoTSF Plenary 27 - Virtual - IoTSF Plenary )

• There is an ETSI webinar session which is free to join on June 11th. I
  would encourage members of the Assurance Working Group to attend if
  possible https://www.etsi.org/events/1653-etsi-security-week-2020#pane-2/


--
Michael Richardson <[e-mail]>, Sandelman Software Works
 -= IPv6 IoT consulting =-