‍
In today’s interconnected world, the proliferation of network-connected products has revolutionized the way we live and work. From smartphones and smart speakers to internet routers and wearable devices, the average household is now equipped with multiple network-connected devices. However, this rapid growth in the Internet of Things (IoT) industry has also brought about significant cybersecurity challenges.

The Risks of Unsecure Smart Devices

The market is flooded with unsecure smart devices, posing a risk not only to their owners but also enabling the creation of botnets for malicious activities. Numerous examples highlight the damage that can be caused by unsecure smart devices. In 2016, the Mirai botnet co-opted over 2,000 routers and smart cameras to launch devastating Distributed Denial of Service (DDoS) attacks¹. Hackers also targeted smart heating systems in apartments, leaving residents without heat². These incidents are not isolated, as attacks against IoT devices have been on the rise, with 1.5 billion attacks reported in the first half of 2021³.

The Need for Legislation

To address this growing concern, the UK government has taken a proactive approach by enacting the Product Security and Telecommunications Infrastructure (PSTI) Act 2022⁴. This comprehensive legislation focuses on enhancing the security of smart devices and the country’s telecommunications infrastructure. The PSTI Act is divided into two parts, with the first part emphasizing device security. Accompanying this is the Security Requirements for Relevant Connectable Products Regulations 2023⁵.

The PSTI Act is a groundbreaking move that establishes the UK as the first country to mandate minimum cybersecurity requirements for consumer connectable products before they are made available for sale. This legislation aims to protect consumers and drive improvements in product security across the industry. It addresses key issues such as default passwords, vulnerability disclosure policies, and the duration of security update support⁶.

Key Provisions of the PSTI Act

The PSTI Act outlines several crucial provisions that organizations responsible for smart devices in the UK must adhere to:

1. No default passwords: Manufacturers must ensure that their devices do not come with default passwords, which are often a weak point exploited by hackers.
2. Vulnerability disclosure policy: Organizations should have a clear policy in place for reporting and addressing security vulnerabilities in their products.
3. Transparency on security updates: Manufacturers must provide information about the minimum length of time for a product’s security update lifecycle, ensuring that devices remain protected throughout their intended lifespan⁶.

The legislation covers a wide range of devices, including smartphones, wearable products, IoT devices, children’s toys, internet routers, smart appliances, and home assistants. The scope of the PSTI Act encompasses anything that can connect to a network or the internet⁶.

The Power of the Secretary of State

The PSTI Act grants the Secretary of State significant authority to enforce security requirements on relevant connectable products. The Secretary of State has the power to specify security requirements to protect consumers and users of such products. These requirements apply to manufacturers, importers, and distributors⁶.

The Act also allows the Secretary of State to issue compliance notices, ensuring that organizations take cybersecurity seriously. Compliance notices can be issued to manufacturers, importers, and distributors, making cybersecurity legally enforceable rather than merely advisory. Importantly, the Act prevents organizations from bypassing security requirements by importing products from outside the UK⁶.

Ensuring Compliance and Accountability

The PSTI Act introduces measures to ensure that organizations comply with security requirements. The Act empowers the Secretary of State to deem compliance with security requirements under certain conditions. Compliance can be determined based on conformity to specified standards or meeting requirements imposed by recognized standards, including those set outside the UK⁶.

It is worth noting that while the legislation does not explicitly cover second-hand products, it does regulate refurbished or reconditioned devices sold as new. This ensures that even these products meet the necessary security standards to protect consumers⁶.

The Act also enables the Secretary of State to issue Stop Notices and Recall Notices. These measures can be imposed on organizations covered by the PSTI Act, forcing them to halt the sale of specified products or recall products already in the market. This mechanism ensures that swift action can be taken to address cybersecurity concerns, similar to how cars can be recalled for safety reasons⁶.

The Grace Period and Penalties

The PSTI Act was given Royal Assent in December 2022, allowing organizations a grace period of 12 months to prepare for compliance. This grace period gives organizations time to establish the necessary systems and policies to meet the security requirements outlined in the legislation. The Act will come fully into force in December 2023⁶.

Organizations that fail to comply with the PSTI Act will face financial penalties. These penalties can include fines of up to £10 million or 4% of the person’s worldwide revenue, whichever is higher. These penalties aim to hold organizations accountable for their cybersecurity practices and drive the adoption of robust security measures⁶.

The Impact on Innovation and Market Dynamics

While there have been concerns that the PSTI Act may stifle innovation and impose financial burdens on startups and emerging technologies, its primary goal is to create a more secure market. By removing insecure products that compete solely on price, the legislation drives the market towards more secure alternatives. This encourages innovation in security and fosters a safer environment for consumers⁶.

The PSTI Act aligns with a broader global trend in cybersecurity regulation. Initiatives such as the EU’s Cybersecurity Act and the California Senate Bill 327 in the United States demonstrate a growing recognition of the importance of cybersecurity in protecting consumers and driving global standards⁶.

The Future of Cybersecurity Regulation

The PSTI Act represents a fundamental shift in how governments approach cybersecurity. By establishing a regulatory framework and enabling enforcement, the Act ensures that security requirements keep pace with technological advancements. The legislation can be easily updated through supplementary material, allowing for flexibility and adaptability in the face of evolving cybersecurity threats⁶.

Regulation and legislation alone are not sufficient; enforcement is crucial. The PSTI Act’s effectiveness will depend on the willingness to take action against non-compliance. With robust enforcement, the PSTI Act can drive significant improvements in the security of smart devices and protect consumers from the risks posed by unsecure products⁶.

In conclusion, the PSTI Act is a landmark piece of legislation that addresses the cybersecurity challenges posed by unsecure smart devices. By mandating minimum security requirements and enforcing compliance, the Act aims to create a safer environment for consumers and drive improvements in product security. As the first of its kind in the world, the PSTI Act positions the UK as a leader in cybersecurity regulation, setting an example for other countries to follow. With the Act coming into full force in December 2023, organizations must prioritize cybersecurity and ensure their products meet the necessary security standards to protect consumers and the integrity of the telecommunications infrastructure.

Additional Information

The PSTI Act complements other cybersecurity initiatives, such as the European Union’s Cybersecurity Act and the California Senate Bill 327. These efforts demonstrate a global recognition of the need for robust cybersecurity measures and the importance of protecting user data and privacy⁷⁸. The National Cyber Security Centre (NCSC) and key allies have also released guidance on smart city security, emphasizing the need to balance cybersecurity risks in the development of smart cities⁹. These collective efforts contribute to a more secure and resilient digital landscape.

Footnotes

1. More than 2,000 TalkTalk routers hijacked by Mirai botnet variant ↩
2. DDoS attack leaves Finnish apartments without heat ↩
3. Kaspersky: Attacks on IoT devices double in a year ↩
4. Product Security and Telecommunications Infrastructure (PSTI) Act 2022 ↩
5. Security Requirements for Relevant Connectable Products Regulations 2023 ↩
6. References from the original article have been rephrased and rewritten to maintain originality. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴
7. Product Security and Telecommunications Infrastructure Bill will reinforce protections for consumer devices and mandate improvements to default security settings ↩
8. European Commission lays out proposed security regulations on device and software security to better protect consumers and drive global standards ↩
9. The NCSC and key allies have drawn up new guidance to help communities balance the cybersecurity risks involved with creating smart cities ↩