Delivering real business benefits across key segments
The Internet of Things (IoT) has gained importance in recent years. It is an umbrella term describing technologies that enable objects and machines to be networked and to communicate with each other, often involving wireless-enabled devices connected over Wi-Fi, Bluetooth or Zigbee.
When assessing an IoT system, it is important to look at the entire system – from the device or smartphone application (app) to the back-end or cloud solution. In addition, more and more IoT devices are being installed in private households as part of a smart home.
The security of IoT products is paramount for consumers and users. Nobody wants to have their personal data hacked because of insufficient encryption between their smartphone and IoT device. This is where TÜV SÜD's cybersecurity tests come in. Our solutions are designed to reveal problem areas and potential security gaps and provide effective remedies. In addition, our tests pre-empt problems that may cause serious damage to a company's reputation.
In principle, the VdTÜV CloT certification programme is application to all consumer IoT devices
To improve the security of networked devices, the European Telecommunication Standards Institute (ETSI) has created a basic 303645 IoT standard within Europe. In the US, cybersecurity requirements for IoT devices are established by the NIST IR 8259 standard.
Here is TÜV SÜD's testing protocol for the NIST IR 8259 standard.
The overwhelming majority of retailers and importers of IoT devices do not design their products even if they are (in most cases) distributed under their own brands. But when it comes to what data is stored and sent to the cloud by more complex IoT devices, transparency is needed. Often, data analysing user behaviour and images is mistakenly transferred, without the user's consent.
To help counteract this, TÜV SÜD uses Man in the Middle (MITM) procedures to analyse the transmission of data by IoT devices. This redirects and decrypts network traffic in order to get an insight into the content of the network traffic (known as the "payload").
Note, however, that this cannot be used on IoT device apps with strong MITM protection technology.
Penetration tests aim to uncover any potential weak points in an IoT device or system and assess its vulnerability to hackers. It works by enlisting an "ethical hacker" to infiltrate the system and look for weak points – without, of course, causing any damage to either the manufacturer or cloud operator. The testing process follows guidelines such as the OWASP IoT Top 10. Furthermore, there are three different types of checks:
Consumer trust is key when you manufacture or retail products that are part of everyone’s daily life
How can we ready ourselves in the face of cyber attacks?
Understand the tests needed for the safety and reliability aspects
Overview of compliance requirements worldwide for electrical and electronic goods.
Consequences and safety solutions
Protecting customers and bring to market a safe and secure product.
Bosnia and Herzegovina