How to Set Up a Foundational Base for Your Cybersecurity Program

IoT Cybersecurity certification services

Ensure safe and secure Consumer Internet of Things (CIoT) device

//CONTACT us

Subscribe for Updates

Achieve IoT Cybersecurity

The Internet of Things (IoT) has gained importance in recent years. It is an umbrella term describing technologies that enable objects and machines to be networked and to communicate with each other, often involving wireless-enabled devices connected over Wi-Fi, Bluetooth or Zigbee.

When assessing an IoT system, it is important to look at the entire system – from the device or smartphone application (app) to the back-end or cloud solution. In addition, more and more IoT devices are being installed in private households as part of a smart home.

The security of IoT products is paramount for consumers and users. Nobody wants to have their personal data hacked because of insufficient encryption between their smartphone and IoT device. This is where TÜV SÜD's cybersecurity tests come in. Our solutions are designed to reveal problem areas and potential security gaps and provide effective remedies. In addition, our tests pre-empt problems that may cause serious damage to a company's reputation.

Our Cybersecurity Services for IoT Devices

certification testing for standards custom services

Certification

Real manufacturer-independent certification (act as a seal of quality)
Based on the GS standard
Based on internationally recognized norms and standards (such as ETSI EN 303 645)
There are three levels of testing: Basic, Substantial and High.
Testing of the IoT product and its development process
Continuous quality optimization via knowledge-sharing between TÜV organizations

diagram

Application

In principle, the VdTÜV CloT certification program is applicable to all consumer IoT devices.

Examples of Typical CIoT Products:

Routers
Personal fitness devices (trackers)
Smart home applications
Wearables
Smart TVs
Smart watches
Toys
White goods such as fridges, washing machines, ovens and dishwashers

The Program Does Not Cover:

Products for cars, air travel and local public transport

Medical devices
Products for defense applications
Critical infrastructure products
Industrial Internet of Things (IIoT) products and products for power stations

IoT Device Security Standards

To improve the security of networked devices, the European Telecommunication Standards Institute (ETSI) has created a basic 303 645 IoT standard within Europe. In the US, cybersecurity requirements for IoT devices are established by the NISTIR 8259 standard.

CLIENT-SPECIFIC SERVICES

IoT security spot check
- Lead time is 10 days (lead time)
- Bilingual (German/English)
Penetration test
Penetration tests aim to uncover any potential weak points in an IoT device or system and assess its vulnerability to hackers. It works by enlisting an "ethical hacker" to infiltrate the system and look for weak points – without, of course, causing any damage to either the manufacturer or cloud operator. The testing process follows guidelines such as the OWASP IoT Top 10. Furthermore, there are three different types of checks:
- Black Box Test: the manufacturer provides no information about the IoT system. The tester has to find a way into the system like a hacker.
- Grey Box Test: certain types of document/information are provided – e.g. hardware plan, SW architecture, risk assessment – so that the tester can target their attacks and identify weak points faster.
- White Box Test: as well as the information in the Grey Box Text, the source code is made available too. We fully understand how sensitive the source code is for manufacturers and how reluctant they are to give it to third parties like TÜV SÜD. However, we have solutions in place to mitigate these concerns.
Training courses and workshops

Our cybersecurity training courses look at basic cybersecurity problems, solutions and how to meet current standards.

We are also happy to offer project-specific workshops if you need support for a particular product/project.

Request a (non-binding) quote now