NTIA drafts best practices for patching IoT
- By Matt Leonard
- Sep 13, 2017
Four working groups formed by the National Telecommunications and Information Administration are just months away from finishing their guidance on upgrading and patching internet-of-things devices.
The Existing Standards, Tools & Initiatives Working Group was tasked with compiling a review of IoT security standards and initiatives, but it found that there are precious few best practices for patching IoT devices.
Only a couple of documents went into any detail on the best practices for patching, Deral Heiland, the co-leader for this group and the research lead at Rapid 7, told GCN after a Sept. 12 meeting on the progress the groups have made. Most of the literature on patching IoT devices, he said, doesn’t go beyond simply saying, "You should patch."
But that’s why he is excited about one of the other working group’s publications.
The Technical Capabilities and Patching Expectations Working Group has been crafting a voluntary framework for the patching process.
Allan Friedman, the director of cybersecurity initiatives at NTIA, presented the progress of this draft publication, saying the goal is to come to a common understanding of what, exactly, it means to have a device that can be updated.
The publication breaks down over-the-air updates into 13 different steps and then details what happens in each one.
“I can’t wait until this is published because I can use this now,” Heiland said. "It’s not a standard, because this isn’t a standards organization, but it's a direction and something to consider."
The draft guidance from the Incentives, Barriers, and Adoption Working Group presents a taxonomy for understanding the incentives and challenges to IoT updatability. It will join the final document from the Communicating Upgradability Working Group in the next few months.
When the final version of these publications are released, the working group members will move onto new issues surrounding IoT, such as authentication requirements, privacy and acceptable lifespans for these technologies.
Matt Leonard is a reporter/producer at GCN.
Before joining GCN, Leonard worked as a local reporter for The Smithfield Times in southeastern Virginia. In his time there he wrote about town council meetings, local crime and what to do if a beaver dam floods your back yard. Over the last few years, he has spent time at The Commonwealth Times, The Denver Post and WTVR-CBS 6. He is a graduate of Virginia Commonwealth University, where he received the faculty award for print and online journalism.
Leonard can be contacted at email@example.com or follow him on Twitter @Matt_Lnrd.
Click here for previous articles by Leonard.