CXO PANEL: Security Certifications for IoT Devices
summary
Panelists argue that OEMs carry commercial accountability while security must flow down the supply chain via contracts and verifiable specs, using component schemes like PSA Certified and regulators’ cybersecurity Act to create vertical criteria. Certification should audit vendor processes (development, patching, incident response) not just single devices, with concrete promises such as a 30-day patch commitment and multi‑year support (five years cited). Threat modeling is mandatory for each use case and heavyweight frameworks like Common Criteria are useful starting points but often too rigid.
AI-written summary · about
chapters (10)
- 0:00Introduction to panel
- 1:06Current role of certifications
- 4:20Supply chain responsibility
- 13:10Threat modeling challenges
- 20:03Compliance vs security value
- 23:01Regulatory mandates debate
- 29:05Impact of major vulnerabilities
- 35:10Certifying processes over devices
- 41:51Key elements of certification
- 45:32Government regulation perspectives
related talks
53mCXO Panel: OT & IoT Risk Management Strategy For CISOs
27mIoT: What will security standards and certification look like ten years from now?
55m[AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
30mSupply Chain Security for IoT Devices
27m4 Panel Session - Bridging Policy and Practice
22mSecuring IoT for Life: Navigating the Challenge of Constant Change
35mIoT security workshop for product managers
15mSecuring IoT: Why Tech Isn't Enough (An NCSC Perspective)