CCDS-GR01-2019

IoT Common Security Requirements
Guidelines 2019:
CCDS-GR01-2019
Ver. 2.0

General Incorporated Association
Connected Consumer Device Security Council
February 26, 2020

Copyright 2020 Connected Consumer Device Security Council Proprietary

CCDS-GR01-2019

Update History
Revision

Date ofDescription of Update

Formulated byUpdate
Draft

2018/11/26

New Release

CCDS

Draft2

2019/3/8

Correction of points in the Common

CCDS

Requirements Review WG
Rev. 1.0

2019/4/11

Rev. 1.0 release

CCDS

Rev. 2.0

2020/2/26

Rev. 2.0 release

CCDS■Trademarks・All company names, product names and the like in this document are either
trademarks or registered trademarks of their respective companies.
■Notice・Information in this document is that available at the time of publication of thisdocument and is subject to change without notice.
・Duplication or reproduction of the contents of this document without prior permission
from the CCDS is strictly prohibited.
Copyright 2020 Connected Consumer Device Security Council Proprietary

CCDS-GR01-2019

1．Purpose of This Document
This Guidelines defines a minimum set of requirements (action level: ★) to be fulfilled
by connected devices. These minimum requirements are to apply to IoT device andsystem implementations of connected devices.

2．Scope of Granting of the CCDS Certification MarkThe scope of granting of the CCDS Certification Mark encompasses those device andsystem implementations of Internet Protocol-ready hardware and software interfaces.

3．Common Requirements
The table below summarizes the common individual requirements.
No.

1

TargetCertification

Kind ofExplanation (Background of theLevel

Requirement

Vulnerability

threat and example)★

There must not

CWE-89: SQL[Background of the threat](Common)be Webinjection

An inadequately invalidated SQL syntaxinput-based SQL

contained in user input could override

injection defects.

security checks or allow statements to beinserted, a backend database to betampered or system commands to beexecuted. (CWE-TOP6)[Examples]
・Wi-Fi wireless router, (CVE-2015-6319)[Remarks]
・Requirements defined in “UK Code ofPractice for consumer IoT security”
13. Validate input data2★

There must not

CWE-352:[Background of the threat](Common)be Web

Cross-site

A vulnerability that arises as a result of

input-based

requestfailure to verify that user requests arecross-siteforgeries

properly formatted. Attackers could fool

request forgery

clients, causing them to transmit

defects.

unintended requests to a Web server.
(CWE-TOP7)

Copyright 2020 Connected Consumer Device Security Council Proprietary1

CCDS-GR01-2019[Examples]
・Wi-Fi wireless router (CVE-2014-7270)[Remarks]
・Requirements defined in “UK Code ofPractice for consumer IoT security”
13. Validate input data
3★

There must not

CWE-22: Path

[Background of the threat](Common)be Webtraversal

The vulnerability of allowing access to a

input-based path

restricted directory by creating a

traversal

pathname from external input.

defects.

(CWE-TOP11)[Examples]・IP camera (CVE-2017-7461)[Remarks]
・Requirements defined in “UK Code ofPractice for consumer IoT security”
13. Validate input data

4★

TCP/UDP ports

CWE-671: Lack

[Background of the threat](Common)out of service

ofIf TCP/UDP ports that are not needed formust not be left

administrator

functional or service purposes are left

open for use

control overopen, they could open a way

from outside.

security

communication that might be abused by(unnecessary

cyber attackers.

TCP/UDP ports[Examples]left open)

・Wi-Fi wireless routers, IP cameras andmore[Remarks]
・Requirements defined in “UK Code ofPractice for consumer IoT security”
6. Minimize exposed attack surfaces

5★

TCP / UDP ports

CWE-287:[Background of the threat](Common)required forInappropriate

Appropriate access control is not

system operation

certification

implemented for the open TCP / UDP

must bepractices

port, threatening problems such as

managed by an(inappropriate

information leaks from the data stored inappropriate

accessthe devices or privilege elevation (seizureCopyright 2020 Connected Consumer Device Security Council Proprietary

2CCDS-GR01-2019

accessmanagement ofof control over the management

authentication

TCP/UDPfunctions) can occur.

method (uniqueports)[Examples]

ID and password

・Wi-Fi wireless routers, IP cameras andfor each device,moreor managed ID[Remarks]

and password

・Requirements defined in “UK Code ofthat should not

Practice for consumer IoT security”

be disclosed to6. Minimize exposed attack surfacesthe outside).

6★

・Certification

CWE-259:[Background of the threat](Common)information

Problems

If certification information used to accessmust be capableassociated witha device or application, such as ID orof being

a hard-coded

password information, is endangered

re-edited

password (suchwhen it is hard-coded or the・When using for

as animplementation prohibits its

the first time, it

inappropriately

modification, there would be no way

has a function toimplemented or

responding to it, leading toprompt tohard-codedvulnerabilities.

change theaccess code or[Examples]

settings.

unmodifiable

・Medical institution systems

・The ID andaccess code).

[Remarks]

password should

・Requirements defined in “Certification

not beof Compliance of Devices with thehard-coded (theRelevant Security Standards”

initial password

・Requirements defined in the “California

can be theState Laws”same).

・Requirements defined in “UK Code ofPractice for consumer IoT security”
1. No Default Password (Certification
information must be set before any
default password can be used.)

7★

・Functions must

Inadequate[Background of the threat](Common)be in place that

implementation

If a function that permits deleting

permit uses toof functions

security settings, confidential

Copyright 2020 Connected Consumer Device Security Council Proprietary3

CCDS-GR01-2019

easily delete

allowing for

information, privacy information andinformation

scrapping orother information retained by devices ordefined orreuse.

applications is not implemented, suchcollected by

・No applicable

information could leak out uponthem whileCWE

scrapping or reuse.

using a device.

[Examples]・Updated・PCs, USB memory smartphones

system software[Remarks]

must be capable

・Requirements defined in the “UK Codeof beingof Practice for consumer IoT security”

maintained even

8. Ensure that personal data is protected

after such

11. Make it easy for consumers to delete

information

personal data

has been deleted.
89★

The latest

CWE-326:[Background of the threat](Common)scheme ofProblems of theThe scheme of communication encryption

certification

absence of anused in the Wi-Fi devices is not the latest

recommended byencryption

one but it employs vulnerable encryption

the Wi-Fi

scheme having

protocol or encryption algorithm.

Alliance must bea strength[Examples]

supported.

(latest Wi-Fi・Wi-Fi wireless routercommunication[Remarks]

encryption

・Requirements covered din the “UK Codefunction notof Practice for consumer IoT security”

implemented).

5. Communicate securely★

The latest

CWE-287:[Background of the threat](Common)pairing scheme

Inappropriate

Specifications earlier than Bluetoothrecommended byauthentication

2.0+EDR would require the devices to be

the Bluetooth(Bluetoothpaired with each other to enter a numeric

SIG must be

pairingsequence, called a “PIN code.” Typically,supported.

function not

implementations involving the entry of a

implemented).

four-digit, such as 0000 are so common
that they could be attacked by entering
pre-planned sequences, compromising
security easily.
[Examples]

Copyright 2020 Connected Consumer Device Security Council Proprietary

4CCDS-GR01-2019

・Devices adhering to specifications
earlier than s Bluetooth 2.0+EDR[Remarks]
・Requirements defined in the “UK Codeof Practice for consumer IoT security”
5. Communicate securely
10★

Unnecessary

Use of device[Background of the threat](Common)device classes

classes that do

The implementation of unnecessary

must be madeno require USB

device classes could open a way for

non-recognizable

・No applicableattacks being launched via malware, forfor system

CWE

example.

operation[Examples]

purposes.

・USB-mounted devices in general[Remarks]
・Requirements defined in “UK Code ofPractice for consumer IoT security”
6. Minimize exposed attack surfaces

11★

・Software

Software[Background of the threat](Common)update must be

update function

If a function that permits updating

possible.

notsoftware or firmware upon detection of・The state of

implemented

vulnerabilities in them is not

software having

・No applicable

implemented, they could be exposed tobeen updated

CWE

attacks taking advantage of theirmust besecurity holes.

maintained even

[Examples]

after the power

・Wi-Fi wireless routers, IP cameras andis turned off.

more
[Remarks]
・Requirements defined in “Certification ofCompliance of Devices with the Relevant
Security Standards”

・Requirements defined the “UK Code ofPractice for consumer IoT security”
3. Keep software updated
9. Make systems resilient to outages
12★

1) A contact for・No applicable[Background]

Copyright 2020 Connected Consumer Device Security Council Proprietary5

CCDS-GR01-2019(Common)information onCWE

Security standards in effect in andproductoutside Japan targeting IoT devices

vulnerabilities

define an organizational plan ormust beoperational scheme for product providers.

available and[Remarks]

made public.

Requirements defined in NISTIR 8259

2) A product“Foundational Cybersecurity Activities

security update

for IoT Device Manufactures”

support site

Activity 6: Decide what to communicate

must beto customers and how to communicate it.

available.

Copyright 2020 Connected Consumer Device Security Council Proprietary6