Cybersecurity for IoT products

Aim

The aim of the course is to provide an understanding of the requirements of the International Cyber security standards ETSI EN 303645 and SSF 1120 for IoT. Participants will learn more about the important concepts of IoT device security, consumer data protection, and requirements of Penetration testing.

Examples of products are the Internet-connected devices such as smart TVs, home assistants, smart speakers, connected home appliances like refrigerators and washing machines, or connected alarms systems, door locks, smoke detectors and baby monitors, among many others.

Continuous and increasing use of Internet-connected things increases the likelihood of cyberattacks. It is essential to understand the prerequisites of the security factor before using IoT to withstand such attacks. The ETSI EN 303645 standard sets the baseline requirements for IoT, supporting IoT security through the design, development, and manufacturing phases of the device.

This course also explains the link between the ETSI EN 303645 and SSF 1120-1 standard for consumer IoT. General requirements are taken from the baseline requirements of ETSI EN 303645. In addition, this standard sets the basic level of protection for consumer data usage and data in storage by the device. 
SSF 1120 also includes device testing requirements, which is carried out in two ways, general testing and penetration testing. This testing provides the scope of excellent security for the consumer IoT.

Duration

Three hours

Location

The training can be delivered either online or onsite at RISE Borås

Cost

3 100 SEK

Goals

• Understanding of general requirements and testing of IoT 
• Understand the necessity of cryptographic algorithms 
• Understanding of security measures in terms of software and hardware 
• Understand how to report and respond to vulnerabilities if found by consumer
• Importance of penetration testing for IoT 
• Understand relatedness between ETSI EN 303645 and SSF 1120 

Course module 

• Introduction 
• Terminology 
• Development requirements 
• Installation requirements 
• Account management 
• Operation 
• Data protection 
• General testing 
• Penetration testing 

Target Group

Managers, Regulator, Hardware Designers, Programmers, Test Engineers, System Engineers, Project Managers, Product Managers, Quality Managers, Operations and Maintenance Personnel and Developers