i3 - September/October 2019 - 21

s e c u r i t y
recommendations" have raised more questions "about
where to start, how to consider such a wealth of overlapping recommendations, and which ones to follow."
That's why there is "a need for a common baseline of security capabilities for all IoT devices" to assure "efficiencies of
scale in development, manufacturing, support, training,
assessment and identification of IoT products with increased
security controls, according to the C2 report.
Mike Bergman, VP of technology & standards, CTA, who
has also headed the C2 project, points to how such cooperation is taking shape. "We're all working in the same direction
with the same goal of baseline security," Bergman explains.
"We're coordinating to assure more alignment" as NIST develops the federal capabilities. "We want to understand if there
might be any differences. These two efforts are quite parallel
and should support each other in their appropriate sectors."
The report explains, "botnets" are at the heart of the cybersecurity defense campaign. Software invaders can "propagate
malware, conduct denial of service attacks and spread disinformation on social media." It cites botnet attacks that include
"more than 30 million 'zombie' endpoints."

IOT AND INSECURITY

Finding successful protections that make finanancial sense
and meet public policy objectives are at the heart of the cybersecurity projects. Among the challenges are finding costeffective ways to assure security in low-cost sensors and

v i a

i3_0919_FEATURE_Cybersecurity.indd 21

11 0 1 0 111 11 0 1 0 111 11 0 1 0 111 11 0 1 0 111 11 0 1 0 111 11 0 1 0 111 11 0 1 0 11

a l i g n m e n t

ensuring that protective systems meet privacy criteria. The
report notes the deluge of IoT devices that "introduce new
concerns regarding the safety, reliability, security, resilience
and privacy of the device, leading to potential reduction in
the overall trustworthiness of the system."
The C2 initiative, which was coordiated by the Council
to Secure the Digital Economy and CTA, includes groups
such as the Association of Home Appliance Manufacturers,
Cable Television Laboratories Inc., CTIA, the Internet of
Secure Things, Underwriters Laboratories Inc., the U.S.
Chamber of Commerce and the United States Telecom
Association. Bergman explains that each of these industry
groups convenes their own membership and security
experts, so the C2 effort-"convene the conveners"-is
leveraging expertise far and wide.
Bergman points out that the C2 white paper is one step
toward a formal technical standard. CTA is developing a
cybersecurity standard designated as "ANSI/CTA-2088,"
which is expected to be ready by year's end. Among the goals
of that document is creation of a national standard that can
be adopted by manufacturers, retailers and others - thus
establishing a single, unified benchmark before state or
regional standards muddle the security barriers.
Matthew Eggers, VP of cybersecurity policy, national security and emergency preparedness at the U.S. Chamber of
Commerce, explains that developing a cybersecurity baseline
is vital, not just for companies but also to help

c o l l a b o r a t i o n

9/9/19 7:04 PM
i3 - September/October 2019

Table of Contents for the Digital Edition of i3 - September/October 2019
