Launched by the IoT Security Foundation (IoTSF), VulnerableThings.com is an online platform designed to help IoT vendors receive, assess, manage and mitigate vulnerability reports. The site simplifies the reporting and management of vulnerabilities whilst helping IoT vendors comply with new consumer IoT security standards and regulations.
As the first globally applicable standard for consumer IoT cybersecurity, the latest ETSI EN 303 645 specification requires IoT vendors – which could include device manufacturers or importers/distributors – to publish a clear and transparent vulnerability disclosure policy; establish an internal vulnerability management procedure; make contact information for vulnerability reporting publicly available; and continually monitor for and identify security vulnerabilities within their products.
Governments around the world including in the UK, Australia, Singapore, Finland and the American states of California and Oregon have already published codes of practice, product labelling schemes or prepared legislation aligned to the standard. Implementing a means to accept vulnerability reports is a common feature of these initiatives. Without mechanisms to report, manage and resolve vulnerabilities – such as Co-ordinated Vulnerability Disclosure (CVD) – the security of consumer IoT products diminishes over time and the risk of attack or abuse increases.
“Vulnerability management is such a fundamental element to IoT cyber-hygiene that it is no surprise that governments and regulators around the world are making this a mandatory requirement,” said John Moor, Managing Director of the IoT Security Foundation.