Guidelines for strengthening cyber security - IoT devices

On 3 March 2023, the Department of Telecommunications (DoT) issued a set of advisory guidelines to machine-to-machine (M2M) / internet of things (IoT) stakeholders for securing consumer IoT (Guidelines). These Guidelines have been issued pursuant to a technical report released by the Telecommunication Engineering Centre titled “Code of Practice for securing Internet of Things (IoT)” (CoP). The CoP inter alia aimed at protecting the users and the networks that connect IoT devices.

Background

IoT is indisputably one of the fastest emerging technologies across the globe and has cut across various industries including healthcare, communications, energy, automobile, public safety, agriculture etc. In view of the extensive application and growing dependency of smart infrastructure, it is crucial to ensure end-to-end security of smart devices. Pertinently, the level of security required for each of such products vary across applications and associated services. In this light, the CoP was issued by TEC for securing consumer IoT products that are connected to the internet and/or home network and associated services such as inter alia connected wearable health devices, smart cameras, TVs, speakers, connected home automation and alarm systems etc.

The CoP, which postulates the concept of ‘Security by Design’ and implementation of the ‘National Trust Centre’, also sets out guidelines for securing such consumer IoT products which include setting unique passwords for IoT devices, implementing a responsible vulnerability disclosure program, securely updating software components, securely storing sensitive security parameters, ensuring protection of personal data, etc. The Guidelines issued by DoT are focused on these aspects and are issued for all stakeholders in this ecosystem, namely M2M service providers, telecom service providers, etc.

Broad guidelines for M2M / IOT stakeholders

Comment

From wrist watches that track your heart rate to factories that can be remotely controlled from a central location, IoT has penetrated numerous households and businesses today. With the remarkable features that these smart devices bring to the table, also comes the high risk of security and privacy concerns. It is now more imperative than ever to take active steps towards minimizing the threat of security attacks and system failures. In the past, the Joint Parliamentary Committee, while commenting on the previous iteration of the data protection bill, also advocated for a mechanism for formal certification process for all digital and IoT devices.

Measures such as mandatory testing and certification of telecommunication equipment (MTCTE) are also, inter alia, aimed at ensuring integrity and strengthening data security of such devices. While the data protection bill is round the corner, the Guidelines issued by the DoT serve as a timely and important piece of advisory to all industry stakeholders engaged in the M2M / IoT business to gear up their cyber security measures to eliminate the production of devices with weak / sub-standard security systems.

-         Harsh Walia (Partner), Shobhit Chandra (Counsel) & Sanjuktha A. Yermal (Associate)

For any queries please contact: editors@khaitanco.com