House Passes Legislation for Minimum IoT Security Standards

The House of Representative has passed legislation that would establish minimum security standards for internet of things devices connected to federal networks. 

Under the Internet of Things Cybersecurity Improvement Act, the National Institute of Standards and Technology will set best practices for device security, and the Office of Management and Budget will later release guidance to help federal agencies meet or exceed the standards. 

“IoT devices are more and more common and fulfill greater and greater functions in our government, especially in this largely digital work environment created by COVID-19," said Rep. Robin Kelly, one of the bill's proponents.

Kelly and Rep. Will Hurd, alongside Sens. Mark Warner and Cory Gardner, have spent over three years attempting to advance the bill, which is now awaiting Senate and presidential confirmation.

Hurd, a two-time Wash100 awardee, said agencies should have an awareness of the known vulnerabilities of their IoT devices regardless of how sophisticated they are to patch.

“It’s real basic – if you’re going to introduce a widget into the digital infrastructure of the federal government and it has a known vulnerability, you either have to patch it or have some way to address it,” Hurd said.

According to three-time Wash100 awardee Warner, most major IoT vendors are “building the more sophisticated IoT devices” and are generally in favor of the legislation. 

He claimed that the bill has experienced pushback among lower-end vendors as they supposedly do not want “to take responsibility to actually remediate known vulnerabilities.”

Defense Intelligence Agency Director Robert Ashley, a two-time Wash100 winner, previously told the Senate Armed Services Committee said the most dangerous emerging cyber threat to national security will be the exploitation of weak mobile devices and the internet of things.