White House unveils Cyber Trust Mark program for consumer devices
1–10 of 164 posts
Re: White House unveils Cyber Trust Mark program for consumer devices
#2Interesting. This is probably a good thing to have around as a baseline for all the iot crap out there
Re: White House unveils Cyber Trust Mark program for consumer devices
#3What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
Re: White House unveils Cyber Trust Mark program for consumer devices
#4Digging for more details, but a lot of the technical requirements (e.g. encryption, password handling, etc.) are still unclear.
Re: White House unveils Cyber Trust Mark program for consumer devices
#5Probably overlaps with the EU RED Cybersecurity requirements for IoT devices that are supposed to go into effect this year: https://www.ul.com/services/ul-solutions-cybersecurity-advis...
Re: White House unveils Cyber Trust Mark program for consumer devices
#6What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.
Re: White House unveils Cyber Trust Mark program for consumer devices
#7The combined requirements of govt purchasing must carry the mark and major US surveillance tech manufacturers like Amazon are leading the rollout, makes this seem less like a cybersecurity concern and more of a protectionist carve out.
Re: White House unveils Cyber Trust Mark program for consumer devices
#8What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
You have to have rules before you can enforce them...
It looks like part of the label [1] will include a QR or link to a public registry, so in theory you can easily confirm the device has actually been certified.
[1] https://docs.fcc.gov/public/attachments/FCC-23-65A1.pdf point 42
Re: White House unveils Cyber Trust Mark program for consumer devices
#9What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
The vendor is supposed to check I think. Not that that makes sense in a comingling inventory world.
I'm sure Amazon - whose store is mostly generic Chinese schlock nowadays - will check.
Not that it matters, posters on this very site who claim to care will continue buying stuff off AliExpress, proud they got it for pennies on the dollar.
Look ma, a mini PC for $22! And they didn't even charge for the preinstalled malware!
Has anyone ever considered this junk is sold at a loss as a price of doing business, to expand a PRC-controlled botnet?
Re: White House unveils Cyber Trust Mark program for consumer devices
#10What's to stop the bad actors from just printing the logo on their gear anyways? Like they do with UL and N95?
They describe it as being like EnergyStar which suggests they'll have a consumer accessible registry as described here:
https://www.ul.com/news/ul-solutions-named-lead-administrato...
> UL Solutions will also work with the FCC and program stakeholders to develop a national registry of certified products that consumers can access via QR code on the label. The registry will have more detailed information about each product. Additionally, UL Solutions will serve as liaison between the FCC and other CLAs, as well as other key stakeholders. [emphasis added]
and here:
https://www.fcc.gov/CyberTrustMark
> The logo will be accompanied by a QR code that consumers can scan, linking to a registry of information with easy-to-understand details about the security of the product, such as the support period for the product and whether software patches and security updates are automatic.
This doesn't block full-blown counterfeit products (recreating certified devices including the label), but does address non-compliant devices trying to pose as compliant.