The FIDO Alliance is teaming up with the IoT Security Foundation (IoTSF) in an effort to promote IoT security. The collaboration will focus primarily on education, insofar as the two organizations will try to teach businesses about the benefits of passwordless authentication, and will provide them with practical, public resources to show them how to integrate passwordless technologies into the design of IoT devices.
The news is in keeping with the Alliance’s mission statement. The organization has repeatedly highlighted the security shortcomings of passwords, especially as the IoT continues to expand. People now need to remember passwords for multiple accounts and devices, and often re-use passwords or use simple passwords that are easier to guess for cybercriminals. Many manufacturers also use universal default passwords, which are vulnerable to DDOS attacks if consumers do not set a new password after they’ve left the factory.
With that in mind, FIDO and the IoTSF are encouraging manufacturers to switch to passwordless forms of authentication. FIDO noted that the new ETSI 303 6453 IoT cybersecurity standard includes a provision for “no universal default passwords,” which will eliminate the practice for businesses hoping to comply with international regulatory and certification programs.
In the meantime, FIDO’s IoT Technical Working Group and the IoTSF’s Security Compliance Framework Working Group have independently worked to provide manufacturers with technical specifications and best practices for IoT security. The new partnership will allow them to consolidate those efforts and create a comprehensive framework to guide future IoT design.
“The use of passwords for security is an outdated and outmoded security practice for the digital age,” said IoTSF Managing Director John Moor. “There are solutions which are stronger from a technical perspective and better from a user’s perspective.”
“The FIDO Alliance mission is to reduce the world’s reliance on passwords with simpler and stronger authentication,” added FIDO Executive Director and COO Christina Hulka. “We look forward to working with the IoT Security Foundation to accelerate our path toward bringing passwordless authentication to IoT.”
The FIDO Alliance held its first annual Authenticate conference in November.