Multistakeholder Process on Internet of Things Security Upgradability and Patching

AGENCY:

National Telecommunications and Information Administration, U.S. Department of Commerce.

ACTION:

Notice of open meeting.

SUMMARY:

The National Telecommunications and Information Administration (NTIA) will convene a virtual meeting of a multistakeholder process on Internet of Things Security Upgradability and Patching on November 8, 2017. This is the sixth in a series of meetings. For information on prior meetings, see Web site address below.

DATES:

The virtual meeting will be held on November 8, 2017, from 2:00 p.m. to 4:30 p.m., Eastern Time. See Supplementary Information for details.

ADDRESSES:

This is a virtual meeting. NTIA will post links to online content and dial-in information on the multistakeholder process Web site at https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security.

FOR FURTHER INFORMATION CONTACT:

Allan Friedman, National Telecommunications and Information Administration, U.S. Department of Commerce, 1401 Constitution Avenue NW., Room 4725, Washington, DC 20230; telephone: (202) 482-4281; email: afriedman@ntia.doc.gov. Please direct media inquiries to NTIA's Office of Public Affairs: (202) 482-7002; email: press@ntia.doc.gov.

SUPPLEMENTARY INFORMATION:

Background: In March of 2015, the National Telecommunications and Information Administration issued a Request for Comment to “identify substantive cybersecurity issues that affect the digital ecosystem and digital economic growth where broad consensus, coordinated action, and the development of best practices could substantially improve security for organizations and consumers.” We received comments from a range of stakeholders, including trade associations, large companies, cybersecurity startups, civil society organizations and independent computer security experts. The comments recommended a diverse set of issues that might be addressed through the multistakeholder process, including cybersecurity policy and practice in the emerging area of Internet of Things (IoT).

In a separate but related matter in April 2016, NTIA, the Department's Internet Policy Task Force, and its Digital Economy Leadership Team sought comments on the benefits, challenges, and potential roles for the government in fostering the advancement of the Internet of Things.” Over 130 stakeholders responded with comments addressing many substantive issues and opportunities related to IoT. Security was one of the most common topics raised. Many commenters emphasized the need for a secure lifecycle approach to IoT devices that considers the development, maintenance, and end-of-life phases and decisions for a device.

After reviewing these comments, NTIA announced that the next multistakeholder process on cybersecurity would be on IoT security upgradability and patching. NTIA subsequently announced that the first meeting of a multistakeholder process on this topic would be held on October 19, 2016. NTIA has convened five subsequent virtual or in-person meetings.

The matter of patching vulnerable systems is now an accepted part of cybersecurity. Unaddressed technical flaws in systems leave the users of software and systems at risk. The nature of these risks varies, and mitigating these risks requires various efforts from the developers and owners of these systems. One of the more common means of mitigation is for the developer or other maintaining party to issue a security patch to address the vulnerability. Patching has become more commonly accepted, even for consumers, as more operating systems and applications shift to visible reminders and automated updates. Yet as one security expert notes, this evolution of the software industry has yet to become the dominant model in IoT.

To help realize the full innovative potential of IoT, users need reasonable assurance that connected devices, embedded systems, and their applications will be secure. A key part of that security is the mitigation of potential security vulnerabilities in IoT devices or applications through patching and security upgrades.

The ultimate objective of the multistakeholder process is to foster a market offering more devices and systems that support security upgrades through increased consumer awareness and understanding. Enabling a thriving market for patchable IoT requires common definitions so that manufacturers and solution providers have shared visions for security, and consumers know what they are purchasing. Currently, no such common, widely accepted definitions exist, so many manufacturers struggle to effectively communicate to consumers the security features of their devices. This is detrimental to the digital ecosystem as a whole, as it does not reward companies that invest in patching and it prevents consumers from making informed purchasing choices.

Stakeholders have identified four distinct work streams that could help foster better security across the ecosystem, one of which has produced a consensus document. The main objectives of the November 8, 2017, meeting are to share progress from the continuing working groups and potentially come to consensus around final products. Stakeholders will also discuss how the outputs of the different work streams can complement each other, and what next steps will be in promoting awareness and use of the outputs. More information about stakeholders' work is available at: https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security.

Time and Date: NTIA will convene a virtual meeting of the multistakeholder process on Internet of Things Security Upgradability and Patching on November 8, 2017, from 2:00 p.m. to 4:30 p.m., Eastern Time. The meeting date and time are subject to change. Please refer to NTIA's Web site, https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security,, for the most current information.

Place: This is a virtual meeting. NTIA will post links to online content and dial-in information on the multistakeholder process Web site at https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security.

Other Information: The meeting is open to the public and the press. There will be an opportunity for stakeholders viewing the webcast to participate remotely in the meeting through a moderated conference bridge, including polling functionality. Access details for the meeting are subject to change. Please refer to NTIA's Web site, https://www.ntia.doc.gov/other-publication/2016/multistakeholder-process-iot-security,, for the most current information.

The meeting is also accessible to people with disabilities. Individuals requiring accommodations, such as other auxiliary aids, are asked to notify Allan Friedman at the contact information listed above at least seven (7) business days prior to the meeting.