2024.06.30. The Fair Economy — An event presenting trends in security certification for Internet of Things (IoT) products and services that support corporate innovation, along with ways to address vulnerabilities, drew attention from the electronics and information and communications industry.
The Korea Electronics Association (KEA) held the 'IoT Product Security and Certification Seminar' on the 27th at the main conference hall of the Electronics Center in Mapo-gu, Seoul.
Major countries abroad, including the United States, the United Kingdom and Japan, have established cybersecurity certification systems for IoT devices and are working to expand their use.
In particular, as cyber intrusions can escalate into threats to national cybersecurity, governments around the world are strengthening their review and control of IoT devices, whose security has been relatively weak amid an emphasis on convenience. This is manifesting as mandatory security certification for IoT devices.
KEA said it held the event to share global trends in IoT device security certification and to provide an opportunity for consultation with specialized cybersecurity companies.
At the event, Jung Won-seok, head of the Software Convergence Center at KTC, introduced trends in IoT security certification at home and abroad and the status of mandatory certification, under the theme 'Why Should We Obtain IoT Security Certification, and Why Does It Matter?'
Center head Jung Won-seok explained that many countries have established certification systems to ensure the security of IoT devices, and that some are moving to make such certification mandatory in order to secure the cybersafety of their citizens, industries and governments.
He also mentioned that mutual recognition of certifications between countries is taking place. This highlights the possibility that certification could act as a barrier in the import and export of IoT devices.
South Korea has upgraded its IoT security certification from a voluntary private-sector certification to a voluntary certification backed by law, and has eased the burden on industry by introducing a relatively low-cost derivative-model certification system.
In addition, Korea is seeking mutual recognition of certifications with foreign countries and mandatory certification for major industrial sectors.
The policy agency overseeing certification is the Ministry of Science and ICT, the certification body is the Korea Internet & Security Agency (KISA), and the testing agencies are the Telecommunications Technology Association (TTA) and KTC.
Center head Jung Won-seok closed his presentation by pledging active support for IoT security certification across the electronics and information and communications industry.
Next, ZIEN CEO Cho Yeong-min gave a presentation titled 'Inspecting IoT Product Security Vulnerabilities and Responding to Security Certification,' introducing major vulnerabilities, inspection methods and ways to respond to security threats.
CEO Cho Yeong-min pointed out that many companies that develop and manufacture IoT devices are small startups or small businesses, and that these companies struggle with securing specialized personnel and covering costs when responding to IoT security regulations and going through the certification process.
He also proposed using automated solutions covering penetration testing, vulnerability analysis and reporting, and review and inspection after remediation, as a way to overcome these challenges.
KEA also plans to launch an IoT product security vulnerability analysis service next month. The service will consist of preliminary meetings, environment setup, inspection, and results reporting. ZIEN's 'Z-IoT' solution will be used for the inspection stage.
Z-IoT, a security-as-a-service (SECaaS) solution developed for IoT device firmware, automates cloud-based analysis of passwords, encryption, executable files, open-source software and zero-day vulnerabilities. This means IoT development and manufacturing companies can use ZIEN's solution quickly and economically, without needing to build and operate their own vulnerability inspection solutions.
0 Comments
No comments yet.