InfoSecBulletin Cybersecurity for mankind
The Federal Communications Commission voted to start a program for labeling wireless consumer Internet of Things products with strong cybersecurity. This means that products meeting these standards will have a “U.S Cyber Trust Mark” label, helping consumers make better choices and encouraging manufacturers to improve cybersecurity.
The Commission has adopted the rules and framework for the program. The program highlights are:
Best Cybersecurity Certifications for Your Career in 2025
CVE-2024-40766
48,000+ Vulnerable SonicWall Devices exposed to ransomware attack
India releases draft Digital Personal Data Protection Rules
Microsoft to invest $80 Billion in AI Data Center
City Bank Customer financial reports posted dark market for sale
3.3 Million Email Server Expose User Passwords and Messages in Plain Text
Memory-Dump-UEFI
Researcher dumping memory to bypass BitLocker on Windows 11
CVE-2024-49112
PoC Exploit Released for Zero-Click vulnerability in Windows
Financial Threat Assessment 2024
BCSI marks Bangladeshi 28 banks high, 10 medium for cyber attack
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster
• The U.S. Cyber Trust Mark logo will initially appear on wireless consumer IoT products that meet the program’s cybersecurity standards.
• The logo will be accompanied by a QR code that consumers can scan for easy-tounderstand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
• The voluntary program will rely on public-private collaboration, with the FCC providing oversight and approved third-party label administrators managing activities such as evaluating product applications, authorizing use of the label, and consumer education.
• Compliance testing will be handled by accredited labs.
• Examples of eligible products may include home security cameras, voice-activated
shopping devices, internet-connected appliances, fitness trackers, garage door openers, and baby monitors.
The Commission is asking for public opinions on extra disclosure requirements. This includes whether the software or firmware for a product is made or used by a company in a country that raises national security concerns. It also includes whether customer data collected by the product will be sent to servers in such a country.
There are many IoT products that use wireless networks. They are made up of different devices and technologies, each with its own security challenges. The Commission proposed a cybersecurity labeling program for IoT last August, and the rules adopted today are based on that proposal.
According to one third party estimate, there were more than 1.5 billion attacks against IoT devices in the first six months of 2021 alone. Others estimate that there will be more than 25 billion connected IoT devices in operation by 2030.
The cybersecurity labeling program is based on existing public and private efforts for IoT cybersecurity and labeling. It highlights the need for ongoing collaboration to help consumers use this technology with more confidence. The Commission approved the action on March 14, 2024.
