In September 2020, it was reported a coffee machine had been hacked by ransomware1. When seemingly benign consumer products can be hacked, what can be done to safeguard our connected devices?
The world is becoming ever more connected. There were an estimated 8.6 billion IoT-connected devices in the world in 2019. This had risen to 15.14 billion in 2023, with the expectation that growth will continue to reach 29.42 billion by 2030. 2
But what is the IoT? In simple terms, IoT is the extension of internet connectivity into physical devices through electronics, software, sensors and actuators that enable interaction and data exchange. This ‘smart’ technology is all around us, in our televisions, speakers, appliances, locks, exercise trackers and even the games we play that connect us to opponents all over the world.
However, alongside the rise in IoT devices, we are also seeing an increase in cyberattacks. A Check Point Research (CPR) report found a 38% increase in attacks between 2021 and 2022, with the most common targets being education, government and healthcare. 3
A cyberattack could result in one of several outcomes. In the case of the coffee machine, a ransom had to be paid to return control of the device to the user, but with other IoT devices, the consequences could be far more severe. For example, a smart speaker could eavesdrop, hospital staff could be locked out of a life support system or bank details could be stolen.
Depending on the individual case, the responses can be very different. In the case of the coffee machine, it can easily be thrown away at minimal cost, but in other cases the consequences might be more serious in terms of disruption and financial cost. The average cost of a data breach was estimated to be USD 4.35 million in 2022. 4
Businesses are now actively responding to the threat. A survey of business leaders by PSA Certified found:
The report also found 68% of responders thought regulation would drive consumer trust in the security of IoT devices. 5
Authorities around the world are responding with a variety of regulations – from the California Consumer Privacy Act (CCPA) and EU General Data Protection Regulation (GDPR) in 2018 to the recent National Institute of Standards and Technology (NIST) Cybersecurity Framework (NISTIR 8259A-NIST 8425) in the US and Australia’s Demand-response Standard AS4755.2.
This move towards more regulation mirrors the increase in IoT devices and cyber threats. However, because implementing new legislation can be slow, and the speed of development in technology and threat is rapid, there is inevitably a regulatory lag.
But is cybersecurity regulation about to catch up?
Many new regulations and standards for consumer products are expected to come into force in the next few years. These include:
Manufacturers and importers of IoT devices, therefore, need to make sure their products conform to relevant regulations, and since consumers are now taking cybersecurity seriously, they need to be able to demonstrate this compliance in an easy to recognize manner. Gaining an advantage in competitive markets requires a comprehensive, technical approach to compliance, which in the US means assessment against NIST 8259 and in Europe (RED and CLS) against ETSI EN 303 645.
We provide comprehensive solutions to support manufacturers and importers in the delivery of compliant products to regulated markets. Our services include training, product design reviews and pre-assessment, evaluations and certification. Through our global network, we can assess all products against required standards, including NIST, RED and CLS, and as a Notified Body, we can issue EU-type certification for products destined for European Markets to show compliance with RED 3.3 (d), (e) and (f).
Compliant products can then carry the internationally recognized SGS Cybersecurity Mark, demonstrating to customers the adoption of best practice and product conformity to defined standards:
Our strategic, step-by-step approach to cybersecurity also lets manufacturers benefit from certification against multiple standards in one evaluation.
Find more news and updates in our Consumer Compact newsletter >
Subscribe to Consumer Compact >
1 Coffee Machine Hit By Ransomware Attack – Yes, You Read That Right
2 IoT connected devices worldwide 2019-2030 | Statista
3 Threat Report 13th January 2023
4 The Costs of Data Breaches in 2022
5 New PSA Certified Report Shows that Consumers are Concerned about Device Security
© SGS Société Générale de Surveillance SA.
