Recently there is a piece IoT security for smart lighting news about UL Recognizes Avi-on Labs as First Commercial Lighting Company to Achieve IoT Security Rating (prnewswire.com). UL has announced that Avi-on Labs, Inc. is the first commercial lighting company to be recognized for achieving UL’s IoT Security Rating- the Platinum level. What does that level mean ?
Have you heard about this third party IoT Security Rating evaluation program at UL ?
To help manufacturers overcome that commercial challenge, UL developed the IoT Security Rating, a security verification and labeling solution for IoT products that categorizes products according to an ascending five-level scale: Bronze, Silver, Gold, Platinum and Diamond. Verified products receive a differentiated UL Verified Mark security label—specifying the achieved security level—and are evaluated on an ongoing basis by UL.
UL’s IoT Security Rating also helps demonstrate security compliance for meeting the threshold of reasonable security features, as required of manufacturers in the first legally binding regulations for consumer IoT in the California and Oregon Cybersecurity Bills that went into effect January 2020.
UL’s IoT Security Rating was developed based on the security framework UL MCV 1376, Methodology for Marketing Claim Verification: Security Capabilities Verified to Level Bronze/Silver/Gold/Platinum/Diamond, which outlines the specific requirements and testing methodologies for each rating level and includes baseline security capabilities that are aligned with global industry frameworks and best practices.
The rating system sets some baseline criteria in seven categories:
- Software updates;
- Data protection;
- Communication Security;
- Privacy Protection;
- Logical Security (composition of the software);
- System Management;
- Processes (how the manufacturer identifies potential new vulnerabilities);
UL has been pushed the Cybersecurity Assurance And Compliance service since May , 2019 with more connected products with certain cybersecurity building into their products to give their customers the peace of mind. Demand for connected IoT products is expected to exceed $10B by 2024, and the global smart home market is expected to be valued at $138B by 2023.
IoT products companies need to build trust, credibility to their customers by certifying their products through a third-party independent IoT security review firm like UL. Most hacks are the result of common weakness and known vulnerabilities. The IoT products company should stay clear of these and adhere to a proven security best practice of IoT security.
How much security assurance does a device need in Smart Home application ?
Not all devices needs the highest level of security ,it will come down to opportunity and value per Laurens van Oijen, solution leader at UL :Ask yourself how easily can the system be accessed and how much value can be gained from such access?
For smart lighting its security requirement would not be that higher level but whenever there is security breach in your products ,your company reputation and credibility with the consumer will deteriorate very soon. consumers are willing to pay a nearly 30% premium for secure products according to CIGI-IPSOS Global Survey in 2019.
As a company, IoT Security kind become a commercial problem as it takes time and money to build good security into IoT products ,but there is no guarantee good return on such investments. That is a key reason big company and small company think and act differently in terms of security challenges within products. The third party security rating is good way to help promote high level of security assurance and warranty the price premiums for products that really emphasis and ensure deliver the unseen security benefits to their customers. With more legally binding regulations for consumer IoT in more States across the county, it is imperative for lighting manufactures to change the product design mindset and invest into the security capability from early product design to production ,and even to active maintenance security after post-sale.
