Business Strategy
Channel Insights
Stay Connected
Acer America
Acer America Corp. is a computer manufacturer of business and consumer PCs, notebooks, ultrabooks, projectors, servers, and storage products.


333 West San Carlos Street
San Jose, California 95110
United States


ChannelPro Network Awards

hello 2
hello 3


July 12, 2022 |

IoT Compliance

IoT’s poor security history means more regulations in the future.

DEVICES FROM THE INTERNET OF THINGS world seemed different from other network-addressable electronics early on. But with cybersecurity concerns on the rise, regulators are catching up, treating IoT devices like any other endpoint.

The IoT Cybersecurity Improvement Act of 2020 is one such effort. The bill requires the National Institute of Standards and Technology (NIST) and the Office of Management and Budget to take specified steps to increase cybersecurity for IoT devices. In response, NIST issued guidance on IoT security and created a risk management framework.

Across the pond, the EU introduced a cybersecurity standard for consumer IoT products in June 2020, and the GSM Association (GSMA), an industry organization representing mobile network operators worldwide, issued IoT Security Guidelines. Those include 85 detailed recommendations for the secure design, development, and deployment of IoT services, with an emphasis on security testing of networked cameras. “We believe this is an important first step,” says Dima Feldman, vice president of product management and marketing at Sony Semiconductor Israel.

As a rule, however, “Most laws applicable to cybersecurity generally would also overlap on IoT,” says Mark Kirstein, vice president of customer service for Cosant Cyber Security in Tempe, Ariz. He mentions HIPAA regulations as an example, since hospitals now use many IoT devices, and many touch the personal health information of patients.

Mark Kirstein

So far, emerging regulations related to IoT security are fairly simple to implement, says Feldman, citing examples such as all devices should have unique passwords and use standard encryption techniques.

Looking forward, though, he foresees more restrictive regulations and certifications coming. “As IoT becomes a part of our life, it will control smart cities, the electrical grid, and other infrastructure, and it must be protected from sophisticated and even ‘government level’ hackers.” Future compliance guidelines will demand that devices deployed in large volumes, or as part of critical systems, undergo mandatory penetration testing, Feldman adds.

How much impact new rules will make is hard to estimate. While end users tend to ignore regulations of all kinds, they’re even more likely to ignore IoT regulations. For instance, Feldman notes, users often disregard physical security guidelines for IoT devices. “Also, there are no requirements for service-level security and monitoring the state of the device.”

That, along with the weak default security protections on many IoT devices, has led to unwelcome news coverage of breaches, such as DDoS attacks launched from IoT cameras back in 2017. “There is practically no regulation to make sure that future IoT devices will not issue similar or more sophisticated attacks in the future,” says Feldman.

Some companies see these gaps as opportunity, he adds, like Palo Alto Networks getting FedRAMP authorization for IoT. MSPs and systems integrators, meanwhile, have plenty of work ahead, Kirstein says. IP cameras were some of the earliest popular IoT devices, so the number of legacy cameras in use that need upgrading or replacing may create a wave of MSP service requests. “Legacy devices need to be isolated, since they often can’t be secured at the endpoint.” Different customers will need different levels of network separation or configuration.

Keeping up with new compliance guidelines for IoT will be tricky, since the low-cost, low-margin devices don’t get much post-sales support from small vendors in the space. In addition, IoT is becoming ubiquitous. Besides the hospital use cases mentioned earlier, office buildings are adding IoT to conference rooms, along with building controls such as HVAC and elevators. Kirstein adds, “IoT for operation in manufacturing is often overlooked as critical infrastructure.”

Kirstein recommends using U.K.-based as a resource. The NIST regulations from the Cybersecurity Improvement Act will roll out slowly, with plenty of attention with each iteration.

In the meantime, Kirstein advises monitoring IoT devices for compliance purposes with the same rigor you apply to other network devices, but remember that device resources will limit security functions, and “patching and upgrading may not be viable.”

Image: iStock

Editor’s Choice

ChannelPro LIVE: Baltimore Builds MSP Relationships, AI Wows Them

May 17, 2024 |

The day-and-a-half event at the DoubleTree by Hilton in Pikesville, MD, featured business-enhancing educational sessions, networking opportunities, and a detailed look at cutting edge technology from leading vendors.

Deepfakes + Generative AI = Major Problems for Business

May 14, 2024 |

Deepfakes that can’t be distinguished from reality threaten to shatter the fundamental hierarchy of human trust and impact businesses.

MSPs React to Comprehensive, Aggressively Priced Kaseya 365

May 1, 2024 |

Hear from MSP peers on the launch of the new Kaseya 365 program — designed to provide a crucial package of tech services at an affordable monthly price.

Related News

Growing the MSP

Explore ChannelPro


Reach Our Audience