IoT: What will security standards and certification look like ten years from now?
summary
A commissioned EU JRC report argues regulators must treat security and safety as one, updating the Product Liability Directive, the NIS rules and CE self‑certification so devices are secure by default and updatable, and creating a European security engineering agency to retain cryptographers and incident experts. Examples cited include Hospira infusion‑pump hacks, Volkswagen key‑fob reverse engineering, Mirai variants at ~10 variants/day, and Tesla shipping autonomy over‑the‑air. The report requires documented vulnerability lifecycles (ISO 3 0 0 1 and 29 17 4 cited) and planning for 20–50 year maintenance.
AI-written summary · about
chapters (14)
- 0:00Intro
- 1:37Problem Statement
- 3:20Background
- 4:53Car makers
- 5:39Embedded systems
- 6:34Medical devices
- 8:26Broken system
- 8:50Security and safety
- 10:38Security and energy
- 11:44The big picture
- 17:38What interests academics
- 17:50Long term maintenance
- 21:26Regulators
- 22:00Detailed recommendations
related talks
22mSecuring IoT for Life: Navigating the Challenge of Constant Change
48mCXO PANEL: Security Certifications for IoT Devices
15mDevice Security Matters More Than Ever
22mIoT Security: Past, Present and Future
33mIoT Security: Past, Present and Future
31mSecuring the Internet of Things
55m[AUDIO] Should there be an Underwriters Laboratories certification for software in IoT products?
15mSecuring IoT: Why Tech Isn't Enough (An NCSC Perspective)