The necessity of IoT Security illustrated by a smart home control on a tablet

IoT Cybersecurity Testing

Security for all devices
in the Internet of Things

IoT cybersecurity audits target the security of all devices on the Internet of Things (IoT). These devices include sensors and actuators as well as back-end connections and optionally communicate with gateways and smartphone apps – security measures to protect against threats should be set up accordingly.

Why IoT cybersecurity?

Digital networking in particular makes applications and components of mobile or static IoT devices vulnerable to attacks. To access a networked device, three main targets are attacked: the device itself, the network and the infrastructure (app, cloud). However, the security of the networked environment, for example in industry, can prevent such external access or IoT attacks. Elements of holistic IoT cybersecurity include:

  • Secure application
  • Robust design
  • Trustworthy handling of private data
  • Update/upgrade behavior of firmware and software
  • Security against attacks on the data validity and authenticity of the communication partners

Holistic reliability: IoT cybersecurity testing at cetecom advanced

A selection of different icons, man in the background clicks on the cloud security symbol

With our cetecom advanced IoT cybersecurity services, we verify the current security status of your networked devices – an important milestone in the market launch of your products. Benefit from our many years of experience in the regulatory certification of products with wireless technologies.

ETSI EN 303 645 and ETSI TS 103 701

ETSI EN 303 645 – Essential requirements

  • Defines basic cybersecurity requirements for consumer IoT devices, but does not include testing or testing procedures
  • Covers all types of consumer IoT devices
  • Includes 33 mandatory requirements and 35 recommendations, including:
    • No universal default passwords
    • Implement a system to manage security vulnerability reports
    • Keeping software up to date
    • Securely storing sensitive security parameters
    • Communicate securely
    • Ensure software integrity
    • Ensuring the security of personal data
    • Make systems resilient to failures
    • Review system telemetry data
    • Easy deletion of user data by the user
    • Ease of installation and maintenance of equipment
    • Validation of input data
    • Data protection requirements
  • Is not suitable to become a harmonized standard under the RED (Radio Equipment Directive)
  • Harmonized standards under RED must contain requirements that are verifiable beyond reasonable doubt (unambiguous test results: yes or no). However, ETSI EN 303 645 contains several result-oriented provisions (e.g. implementation of cryptographic best practices) that are not testable in this way.

ETSI TS 103 701 – Conformity assessment of basic requirements

  • Describes how to assess the compliance of consumer IoT devices with ETSI EN 303 645
  • Contains 109 tests

Regulation (EU) 2022/30 - RED Article 3.3, letters d), e) and f)

The Radio Equipment Directive (RED) 2014/53/EU sets the legal framework for all products that use radio technologies. The main defined requirements are health and safety, electromagnetic compatibility and efficient use of radio frequencies. Manufacturers and suppliers of these products must demonstrate compliance with RED in the EU market by providing a type examination based on technical documentation (TD) or a declaration of conformity (DoC) and CE marking.

In January 2022, Delegated Regulation EU 2022/30 was published in the Official Journal of the EU. This regulation supplements parts of Article 3.3 of the RED and thus becomes relevant for manufacturers of products with wireless technologies who want to place their products on the EU market.

Delegated Regulation EU 2022/30 defines requirements in the area of cybersecurity for products covered by the RED. This relates in particular to letters d) to f) of Article 3.3:

“d) They do not have a harmful effect on the network or its operation, nor do they cause misuse of network resources, which would cause an unacceptable degradation of service.

e) They have security devices to ensure that personal data and the privacy of the user and subscriber are protected.

f) They support certain fraud protection features.”

Delegated Regulation (EU) 2022/30 – Radio equipment types

Essential Requirements Applicable Radio Equipment NOT Applicable Radio Equipment
RED Article 3.3 point (d)
(does not harm the network)
any internet-connected radio equipment
(directly or via any other equipment)
  • medical devices (Regulation (EU) 2017/745)
  • in vitro diagnostic medical devices (Regulation (EU) 2017/746)
RED Article 3.3 point (e)
(personal data and privacy are protected)
capable of processing personal data, traffic data or location data

  • childcare
  • toys (Directive 2009/48/EC)
  • wearables
  • other internet-connected radio equipment
  • medical devices (Regulation (EU) 2017/745)
  • in vitro diagnostic medical devices (Regulation (EU) 2017/746)
  • civil aviation (Regulation (EU) 2018/1139)
  • motor vehicles, trailers, systems, components and STUs (Regulation (EU) 2019/2144)
  • electronic road toll systems (Directive (EU) 2019/520)
RED Article 3.3 point (f)
(protection from fraud)
any internet-connected radio equipment to transfer money, monetary value or virtual currency (Directive (EU) 2019/713)

  • payment

 

From August 1, 2024, manufacturers must test their products for the new cybersecurity requirements and declare compliance with Delegated Regulation EU 2022/30. This affects both devices that are newly approved and devices that enter the EU market after August 1, 2024.

The current problem, however, is that the cybersecurity requirements based on the new regulation are not yet harmonized and therefore accredited testing is not yet possible. Nevertheless, our Notified Bodies under the Radio Equipment Directive (RED) can support you in making reliable statements on the conformity of your products.

Do you have any questions about cybersecurity tests according to the Radio Equipment Directive (RED)?
Contact us, we look forward to your inquiry:
mail@cetecomadvanced.com / Phone: +49 2054 9519 0

CTIA Cybersecurity Certification Test Plan for IoT Devices

ctia – everything wireless

Our laboratories in Germany and the USA have been recognized by CTIA as Authorized Test Laboratory (ATL) for the CTIA Test Plan for IoT devices.

The CTIA Cybersecurity Test Plan defines test cases that must be performed with the device in an Authorized Test Laboratory (ATL) to obtain CTIA Cybersecurity certification. The certification is defined for three levels of security.

The first level tests basic security features of IoT devices, while the second and third levels test security elements for devices with increasing complexity and manageability.

Cybersecurity for IoT devices in wireless networks

  • The program was developed with the support of wireless network operators
  • Creates an industry-wide best practice for IoT security in wireless networks
  • First cybersecurity program of its kind with support from wireless operators, OEMs and labs
  • Test plan is continuously updated by the Cybersecurity Working Group
  • Test plan version 1.2.3 is active (contains 80 tests)

Main requirements of the certification program

  • Testing must be performed in a CTIA authorized test lab (ATL).
  • IoT devices must support LTE, 5G or WLAN (GSM, CDMA and UMTS are not considered).
  • Wireless personal area network technologies (ZigBee, Bluetooth, Bluetooth Low Energy) are likely to be added in the future

Based on the cetecom advanced test report, you will receive an IoT cybersecurity certification from CTIA according to the latest CTIA requirements.

The CyberSecurity Certified (CSC) Label

CSC 'Cybersecurity Certified' label

Cybersecurity is becoming an integral part of product or device security and can have a positive signal effect on product sales with clear legal requirements and independent cybersecurity tests. A first step has been taken – a Europe-wide security certificate is offered by the new test mark: the CyberSecurity Certified (CSC) label.

As part of this three-stage approval process, we and our partner TÜV NORD are focusing on meeting the fundamental requirements for secure development and operation throughout the product’s lifecycle. These requirements are largely based on the basic cybersecurity requirements for consumer IoT devices according to ETSI EN 303 645.

The following aspects of cybersecurity are considered as part of the device certification process:

  • Secure product development and documentation.
  • Internal cybersecurity audits, e.g. nmap scan, vulnerability scan, static and dynamic code analysis, input validation.
  • Secure operations, related to authentication
  • Password management
  • Data storage
  • Secure product lifecycle, related tto
    • Update mechanism
    • Security update information
    • Reset to factory settings
    • Patch management
    • Vulnerability management
    • Incident management
    • Change and risk management

Based on the cetecom advanced test report, you will receive the CyberSecurity Certified (CSC) label
from TÜV NORD and certification according to the latest CSC cybersecurity requirements.

Further Topics

News on the topic of IoT & cybersecurity

Stay up to date.
The cetecom advanced newsletter is sent out about once a month. No constant follow-up mails.
Only selected content from our experts.