Transcription
Code of PracticeSecuring theInternet of Thingsfor Consumers
Commonwealth of Australia 2020With the exception of the Commonwealth Coat of Arms, all material presentedin this publication is provided under a Creative Commons Attribution 4.0International license at ode.This means this license only applies to material as set out in this document.The details of the relevant license conditions are available on theCreative Commons website at https://creativecommons.org/ as is the full legal codefor the CC BY 4.0 license at ode.Use of the Coat of ArmsThe terms under which the Coat of Arms can be used aredetailed at the Department of the Prime Minister and Cabinet wealth-coat-arms.Contact usEnquiries regarding the licence and any use of this document are welcome at:Department of Home AffairsPO Box 25BELCONNEN ACT 2616P - 20-02351
IntroductionThe Internet of Things (IoT), which includeseveryday smart devices that connect tothe internet – such as smart TVs and homeassistants – provides significant benefitsto Australians; enhancing our convenience,comfort and efficiency. Many of these devicesare developed with functionality as a priority,and security features are often absent or anafterthought. By 2030, it is estimated thatthere will be more than 21 billion IoT devicesconnected to the internet globally, with thehighest estimations predicting over 64 billiondevices. It is essential that these devices in ourhomes and businesses have cyber securityprovisions that defend against potential threatsand malicious cyber activity.The Code of Practice: Securing the Internetof Things for Consumers (Code of Practice)represents a first step in the AustralianGovernment’s approach to improve the securityof IoT devices in Australia. This Code of Practiceis a voluntary set of measures the AustralianGovernment recommends for industry as theminimum standard for IoT devices. The Code ofPractice will also help raise awareness of securitysafeguards associated with IoT devices, buildgreater consumer confidence in IoT technologyand allow Australia to reap the benefits ofgreater IoT adoption.The Code of Practice was developed by theDepartment of Home Affairs, in partnership withSecuring the Internet of Things for Consumersthe Australian Signals Directorate’s AustralianCyber Security Centre, and follows nation-wideengagement with industry and the Australianpublic. The Code of Practice was recognisedas a necessary step to lifting the cyber securityof internet-connected devices domestically.The Code of Practice is designed for an industryaudience and comprises 13 principles. TheAustralian Government recommends industryprioritise the top three principles because actionon default passwords, vulnerability disclosureand security updates will bring the largestsecurity benefits in the short term.In acknowledgement of the global natureof this issue, the Code of Practice aligns withand builds upon guidance provided by theUnited Kingdom and is consistent with otherinternational standards. The principles will helpinform domestic and international manufacturersabout the security features expected of devicesavailable in Australia.Ensuring the security and integrity of IoTdevices will enhance the way we live andwork. By improving the overall cyber securityof these devices, we also deter the risks theypose to Australian families, our economy andnational security.This Code of Practice will be reviewed on aregular basis to ensure it remains fit for purpose.1
ApplicationThis Code of Practice constitutes a voluntary set of principles, and compliance with these principlesis encouraged but optional. Any entity choosing to comply with the Code of Practice may doso in accordance with all or some of the principles contained in the Code of Practice. Where theCode of Practice has been partially complied with, the entity should state the specific principlethat is in compliance. For example, by stating, “Our organisation has complied withprinciples 1, 2 and 3 of the Code of Practice: Securing the Internet of Things for Consumers”.2Code of Practice
PrinciplesPrincipleDescription1.IoT device (and associated backend/cloud account) passwords shouldbe unique, unpredictable, complex and unfeasible to guess, and notresettable to any factory default value that is common to multiple devices.Associated web services should use Multi-Factor Authentication, notprovide any unnecessary user information prior to authentication, andany password reset process should appropriately authenticate the user.No duplicateddefault or weakpasswordsPrimarily applies to Device Manufacturers.2. Implement avulnerabilitydisclosurepolicyIoT device manufacturers, IoT service providers and mobile applicationdevelopers should provide a public point of contact as part of avulnerability disclosure policy in order for security researchers and othersto report issues. Disclosed vulnerabilities should be acted on in a timelymanner. Implementing a bug bounty program encourages and rewardsthe cyber security community for identifying and reporting vulnerabilities,thereby facilitating the responsible and coordinated disclosure andremediation of vulnerabilities.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.Securing the Internet of Things for Consumers3
PrincipleDescription3. Keep softwaresecurelyupdatedSoftware (including firmware) on IoT devices, including third party and opensource software, as well as associated web services, should be securelyupdateable. Updates should be timely and not impact the device’sfunctionality. Updates should also not change user-configured preferences,security or privacy settings without prior approval from the user. The needfor each update should be made clear to consumers, and updates shouldbe easy to implement and applied automatically by default. The deviceshould verify that updates are from a trusted source e.g. via use of a trusteddigital signature. Updates should be distributed via secure IT infrastructureto mitigate the trusted source being compromised. For constrained devicesthat cannot physically be updated, the product should be isolatable andreplaceable. Where possible, vendors should inform the user when theirconstrained device is no longer fit for purpose.An end-of-life policy should be clear to the consumer including when theyacquire the device, which explicitly states the minimum length of time forwhich a device will receive software updates, the reasons for this timeframeand a commitment and method to warn consumers when the product willno longer receive updates. If a user interface is available it should clearlydisplay when a device has reached its end-of-life, inform the user of therisk of security updates no longer being available and provide suggestionsfor mitigating this risk.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.4. Securely storecredentialsAny credentials should be stored securely within devices and on services.Hard-coded credentials (e.g. usernames and passwords) should not beembedded in device software or hardware since they can be discoveredvia reverse engineering.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.4Code of Practice
PrincipleDescription5. Ensure thatpersonal datais protectedWhere devices and/or services process personal data, they must do soin accordance with data protection law e.g. the Privacy Act 1988 andAustralian Privacy Principles. Personal data should only be collected ifnecessary for the operation of the device, and privacy settings on a deviceshould be set to privacy protective by default. Adequate industry-standardencryption, as articulated in the Australian Government InformationSecurity Manual, should be applied to personal data in transit and data atrest. Consumers should be provided with clear and transparent informationabout what data is being used and how, by whom, and for what purposes,for each device and service. This also applies to any third parties thatmay be involved (including advertisers). Where personal data is processedon the basis of consumers’ consent, this should be validly and lawfullyobtained from an adult, with those consumers being given the opportunityto withdraw it at any time.Several other principles in this document are related to protecting personaldata, such as installing and securely configuring devices, as well asdeleting personal data.Primarily applies to Device Manufacturers, IoT Service Providers,Mobile Application Developers and Retailers.6. Minimiseexposed attacksurfacesDevices and services should operate on the ‘principle of least privilege’.Unused functionality should be disabled; hardware should notunnecessarily expose access (e.g. unrequired ports should be closed,the web management interface should only be accessible to the localnetwork unless the device needs to be managed remotely via theInternet); functionality should not be available if they are not used; andcode should be minimised to the functionality necessary for devices andservices to operate. Software should run with appropriate privileges, takingaccount of both security and functionality. To further reduce the numberof vulnerabilities, use a secure software development process and performpenetration testing.Primarily applies to Device Manufacturers and IoT Service Providers.7.EnsurecommunicationsecurityData requiring confidentiality or integrity protection, or associatedwith remote management and control, should be encrypted in transit,appropriate to the properties of the technology and usage. All credentialsand certificates should be managed securely. All remote access shouldbe logged, with logs including the date, time and source of access ata minimum.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.Securing the Internet of Things for Consumers5
PrincipleDescription8. EnsuresoftwareintegritySoftware (including firmware) on IoT devices should be verified usingsecure boot mechanisms. If an unauthorised change is detected, thedevice should alert the consumer/administrator to an issue and shouldnot connect to wider networks than those necessary to performthe alerting function.Primarily applies to Device Manufacturers.9. Make systemsresilient tooutagesResilience should be built into IoT devices and services where required bytheir usage or by other relying systems, taking into account the possibilityof outages of data networks and power. As far as reasonably possible, IoTdevices should remain operating and locally functional in the case of a lossof network, without compromising security or safety. They should recovercleanly in the case of restoration of a loss of power. Devices should be ableto return to a network in a sensible state and in an orderly fashion, ratherthan all attempt to reconnect at the same time. Implementing redundancyand DDoS mitigation helps ensure that IoT services remain online. ArchitectIoT devices to continue functioning as much as possible if an associatedIoT service becomes unavailable, and disclose upfront to the consumerwhich features will cease working in this case. IoT service providersshould also update data when network connection is restored.Primarily applies to Device Manufacturers and IoT Service Providers.10. Monitor systemtelemetry dataIf telemetry data is collected from IoT devices and services, such as usageand measurement data, it should be monitored for security anomalies.Primarily applies to Device Manufacturers and IoT Service Providers.11. Make it easyfor consumersto deletepersonal dataDevices and services should be configured such that personal datacan easily be removed when there is a transfer of ownership, when theconsumer wishes to delete it and/or when the consumer wishes to disposeof the device. Consumers should be given clear instructions on howto delete their personal data, including how to reset the device to“factory default” and delete data stored on the device and inassociated backend/cloud accounts and mobile applications.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.6Code of Practice
PrincipleDescription12. Makeinstallation andmaintenanceof devices easyInstallation and maintenance of IoT devices should employ minimal stepsand follow Australian Government best practice on security1 and usability.2Consumers should also be provided with clear and straightforwardguidance on how to securely set up their device and maintain it throughits lifecycle. Accessibility options on a device should be enabled by default.Primarily applies to Device Manufacturers, IoT Services Providersand Mobile Application Developers.13. Validateinput dataData received via user interfaces, application programming interfaces(APIs) and network interfaces should be validated. Ensure data inputis authorised and conforms to expectations.Primarily applies to Device Manufacturers, IoT Service Providersand Mobile Application Developers.1Australian Signals Directorate’s ‘How to implement the Code of Practice: Securing the Internet of Things for Consumers’.2 Digital Transformation Agency’s ‘Accessibility and Inclusivity Guide’.Securing the Internet of Things for Consumers7
DefinitionsConsumer IoT: Consumers may take many forms.Governments, businesses and individuals mayall be consumers of IoT devices. This Code ofPractice particularly focuses on consumer grade,internet-connected devices and associatedapplications (e.g. wearable devices, and homeappliances such as “smart” televisions andrefrigerators). This group of devices does notinclude mobile phones – as they are consideredsophisticated devices and other guidance maymore accurately apply.Mobile Application Developers: Entities thatdevelop and provide applications that runon mobile devices. These are often offeredas a way of interacting with devices as partof an IoT solution.Retailers: The sellers of internet-connectedproducts and associated services to consumers.Device Manufacturer: The entity that createsan assembled final internet-connected product.A final product may contain the products ofmany different manufacturers.IoT Service Providers: Companies that provideservices such as networks, cloud storage anddata transfer which are packaged as part of IoTsolutions. Internet-connected devices may beoffered as part of the service.8Code of Practice
(Code of Practice) represents a first step in the Australian Government's approach to improve the security of IoT devices in Australia. This Code of Practice is a voluntary set of measures the Australian Government recommends for industry as the minimum standard for IoT devices. The Code of Practice will also help raise awareness of security
