Manufacturers will be required to inform consumers how often their devices will receive security software updates.
The UK's "design-safe" regulations for the Internet of Things (IoT), designed to protect consumers from cyberattacks, now also include smartphones.
Due to the general lack of security controls associated with IoT devices, including easily guessable preset passwords, the initially proposed regulations only covered Internet of Things (IoT) devices.
A government-commissioned report found that nearly half (49%) of UK residents have purchased at least one smart device since the start of the pandemic, such as an AI-powered smart speaker, a video doorbell, or a mobile-controlled light bulb. The study found that while these products have the potential to improve consumers' lives, they also make them particularly vulnerable to cyberattacks. They also pose a threat to businesses as people shift to remote work on a massive scale.
In a recent policy document, the government announced that smartphones will also be included in the proposed "design-safe" legislation. This will require manufacturers, such as smartphone giants Apple or Samsung, to inform consumers at their stores when security software updates are available and to provide public contact information to streamline vulnerability reporting.
Digital Infrastructure Minister Matt Warman said that “phones and smart devices can be a goldmine for hackers to steal data,” adding that despite this, “a large number of users are still running older software with vulnerabilities in their security systems.”
He said, "We are amending the law to ensure that consumers know how long critical security updates are supported before they buy a product, and to make devices harder to hack by banning easily guessed default passwords. These reforms, supported by technology associations around the world, will thwart the efforts of cybercriminals and advance our mission to make us more secure in the face of the pandemic."
Dr. Ian Levy, Technical Director of the National Cyber Security Center (NCSC), said: “Consumers are becoming increasingly reliant on connected products at work and at home. The COVID-19 pandemic has only accelerated this trend, and while manufacturers of these devices are gradually improving their security practices, it’s not good enough.”
