CCDS-GR01-2021



IoT Common Security Requirements
Guidelines 2021:
CCDS-GR01-2021
Ver. 1.0

General Incorporated Association
Connected Consumer Device Security Council
November 24, 2020

Copyright 2020 Connected Consumer Device Security Council Proprietary

CCDS-GR01-2021

Update History
Revision

Date ofDescription of Update

Formulated by

Rev. 1.0 release

CCDSUpdate
Rev. 1.0

2020/11/24■Trademarks
・All company names, product names and the like in this document are either trademarks orregistered trademarks of their respective companies.
■Notice・Information in this document is that available at the time of publication of this document
and is subject to change without notice.
・Duplication or reproduction of the contents of this document without prior permission fromthe CCDS is strictly prohibited.

Copyright 2020 Connected Consumer Device Security Council Proprietary

CCDS-GR01-2021

1．Purpose of This Document
This Guidelines defines a minimum set of requirements (action level: ★) to be fulfilled byconnected devices. These minimum requirements are to apply to IoT device and system
implementations of connected devices.

2．Scope of Granting of the CCDS Certification MarkThe scope of granting of the CCDS Certification Mark encompasses those device and system
implementations of Internet Protocol-ready hardware and software interfaces.

3．Common Requirements
The table below summarizes the common individual requirements.
.

TargetCategory ofCertification

Kind ofExplanation (Background ofLevel

Revision from

Requirement

Vulnerability

the threat and example)

There must not

CWE-89: SQL[Background of the threat]be Webinjection

An inadequately invalidated

the 2019
Requirements
1★

－(Common)input-based SQL

SQL syntax contained in user

injection defects.

input could override security
checks or allow statements tobe inserted, a backend
database to be tampered orsystem commands to beexecuted. (CWE-TOP6)[Examples]
・Wi-Fi wireless router,(CVE-2015-6319)[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
13. Validate input data

2★

－There must not

CWE-352:[Background of the threat]

Copyright 2020 Connected Consumer Device Security Council Proprietary1

CCDS-GR01-2021(Common)be Web

Cross-site

A vulnerability that arises as a

input-based

requestresult of failure to verify thatcross-siteforgeries

user requests are properlyrequest forgery

formatted. Attackers could fooldefects.

clients, causing them totransmit unintended requests
to a Web server.
(CWE-TOP7)[Examples]
・Wi-Fi wireless router(CVE-2014-7270)[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
13. Validate input data3★

－(Common)There must not

CWE-22: Path

[Background of the threat]be Webtraversal

The vulnerability of allowing

input-based

access to a restricted directory

path traversal

by creating a pathname fromdefects.

external input. (CWE-TOP11)[Examples]・IP camera (CVE-2017-7461)[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
13. Validate input data

4★

－(Common)

TCP/UDP ports

CWE-671: Lack

[Background of the threat]out of service

ofIf TCP/UDP ports that are notmust not be left

administrator

needed for functional or service

open for use

control overpurposes are left open, theyfrom outside.

security

could open a way(unnecessarycommunication that might be

TCP/UDP ports

abused by cyber attackers.

left open)[Examples]

Copyright 2020 Connected Consumer Device Security Council Proprietary2

CCDS-GR01-2021

・Wi-Fi wireless routers, IP
cameras and more
[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
6. Minimize exposed attack
surfaces
5

Modified★
(Common)Appropriate

CWE-287:[Background of the threat]certification

Inappropriate

Appropriate certification

practices

certification

practices or communication(unique IDs andpractices

access control is not

passwords are(inappropriate

implemented on the open ports

assigned byaccessrelevant to system operationsdevice) andmanagement ofin the TCP/UDP sessions,communicationTCP/UDP

threatening problems such asaccess controlports)

information leaks from themust be in place

data stored in the devices orin the TCP/UDP

privilege elevation (seizure ofsessions

control over the management

relevant tofunctions) can occur.

system[Examples]

operations.

・Wi-Fi wireless routers, IP
cameras and more
[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
6. Minimize exposed attacksurfaces

6Modified★
(Common)・Certification

CWE-259:[Background of the threat]

informationProblems

If certification informationmust be capableassociated withused to access a device orof beinga hard-coded

application, such as ID orre-edited (thatpassword (suchpassword information, isis, it is not

as anendangered when it is

Copyright 2020 Connected Consumer Device Security Council Proprietary3

CCDS-GR01-2021

hard-coded).

inappropriately

hard-coded or the

implemented or

implementation prohibits its

hard-coded

modification, there would be noaccess code or

way responding to it, leading tounmodifiable

vulnerabilities.

access code).

[Examples]・Medical institution systems[Remarks]
・Requirements defined in“Certification of Compliance ofDevices with the Relevant
Security Standards”
・Requirements defined in the“California State Laws”
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
1. No Default Password(Certification informationmust be set before any default
password can be used.)

7★

－(Common)・Functions must

Inadequate[Background of the threat]

be in place that

implementation

If a function that permits

permit uses toof functions

deleting security settings,

easily delete

allowing for

confidential information,

information

scrapping or

privacy information and otherdefined orreuse.

information retained bycollected by

・No applicabledevices or applications is notthem whileCWE

implemented, such information

using a device.

could leak out upon scrapping・Updatedor reuse.

system software[Examples]must be capable

・PCs, USB memoryof being

smartphones

maintained even

[Remarks]

after such・Requirements defined in the

Copyright 2020 Connected Consumer Device Security Council Proprietary

4CCDS-GR01-2021

information“UK Code of Practice forhas been

consumer IoT security”

deleted.

8. Ensure that personal data isprotected
11. Make it easy for consumers
to delete personal data

8★

－(Common)The latest

CWE-326:[Background of the threat]

scheme ofProblems of theThe scheme of communication

certification

absence of an

encryption used in the Wi-Fi

recommended byencryption

devices is not the latest one but

the Wi-Fi

scheme having

it employs vulnerable

Alliance ® musta strength

encryption protocol or

be supported.

(latest Wi-Fi

encryption algorithm.

communication[Examples]

encryption

・Wi-Fi wireless routerfunction not[Remarks]

implemented).

・Requirements covered din the“UK Code of Practice for
consumer IoT security”
5. Communicate securely

9★

Additional1) The latest

CWE-287:[Background of the threat](Common)requirements

pairing scheme

Inappropriate1) Specifications earlier thanrecommended bycortication

Bluetooth 2.0+EDR would

the Bluetooth

procedure

require the devices to be paired

SIG must be(Bluetoothwith each other to enter a

supported.

pairing

numeric sequence, called a2) Profiled

function not“PIN code.” Typically,irrelevant toimplemented).

implementations involving theBluetooth must

entry of a four-digit, such as

not be0000 are so common that theyrecognizable.

could be attacked by entering

3) Bluetoothpre-planned sequences,devices must becompromising security easily.

free from2) The implementation ofBlueborne

unnecessary Bluetoothvulnerabilities.

protocols could open a way for

Copyright 2020 Connected Consumer Device Security Council Proprietary5

CCDS-GR01-2021

attacks being launched.
3) Use of any device with
Blueborne vulnerabilities
inherent could allow third
parties to use the device attheir discretion.
[Examples]・Devices adhering tospecifications earlier than sBluetooth 2.0+EDR[Remarks]
・Requirements defined in the“UK Code of Practice for
consumer IoT security”
5. Communicate securely
10★

－(Common)Unnecessary

Use of device[Background of the threat]

device classes

classes that doThe implementation ofmust be madeno require USB

unnecessary device classes

non-recognizable

・No applicable

could open a way for attacks

for system

CWE

being launched via malware,

operationfor example.

purposes.

[Examples]・USB-mounted devices ingeneral[Remarks]
・Requirements defined in “UK
Code of Practice for consumer
IoT security”
6. Minimize exposed attacksurfaces

11★

－(Common)・Software

Software[Background of the threat]

update must be

update function

If a function that permits

possible.

not

updating software or firmware

・The state of

implemented

upon detection ofsoftware having

・No applicablevulnerabilities in them is notbeen updated

CWE

implemented, they could be

Copyright 2020 Connected Consumer Device Security Council Proprietary

6

CCDS-GR01-2021

must beexposed to attacks taking

maintained evenadvantage of their security

after the powerholes.

is turned off.

[Examples]
・Wi-Fi wireless routers, IP
cameras and more
[Remarks]
・Requirements defined in“Certification of Compliance ofDevices with the Relevant SecurityStandards”

・Requirements defined the“UK Code of Practice for
consumer IoT security”
3. Keep software updated
9. Make systems resilient tooutages
12New★
(Common)1) A contact for・No applicable[Background]information onCWE

Security standards in effect inproductand outside Japan targetingvulnerabilities

IoT devices define anmust beorganizational plan oravailable andoperational scheme for productmade public.

providers.

2) A product[Remarks]

security update

Requirements defined insupport siteNISTIR 8259 “Foundationalmust be

Cybersecurity Activities for IoT

available.

Device Manufactures”
Activity 6: Decide what tocommunicate to customers andhow to communicate it.

Copyright 2020 Connected Consumer Device Security Council Proprietary7