REQUESTFORCOMMENTRESPONSE

CallforPapersonCybersecurityLabelingProgramsforConsumers:InternetofThings(IoT)

DevicesandSoftware

August17,2021

I.INTRODUCTION

InresponsetoNIST’scallforpublicpapersoncybersecuritylabellingprogramsforconsumers,

CrowdStrike

offersthefollowingviews.

Weapproachthesequestionsfromthestandpointofaleadinginternational,US-headquartered

cloud-nativecybersecurityproviderthatdefendsgloballydistributedenterprisesfromglobally

distributedthreats.CrowdStrikeoffersinsightsinformedbymultiplepracticeareas:cyberthreat

intelligence;proactive,incidentresponseandmanagedsecurityservices;andanAI-powered

software-as-a-servicecybersecurityplatformandmarketplace.Accordingly,thisperspectiveis

informedbyCrowdStrike’sroleinprotectingorganizationsfromdatabreachesandavarietyof

othercyberthreats.

II.COMMENTS

ExecutiveOrder(“EO”)14028requiresNISTtoinitiatetwolabelingeffortsregarding

Internet-of-Things(“IoT”)devicesandsoftwaredevelopmentpractices.CrowdStrikecommends

NISTforundertakingtheseeffortsinadeliberateandconsultativemanner.

Callforpapers- scopenote

WeunderstandthattheIoTinitiativeisdeliberatelyscopedtofocusonbetterinformingconsumers

and

providingmoreclarityintheconsumermarketplace.However,someofourcommentsreflect

and/oracknowledgethatIoTdevicesprimarilydesignedforconsumerusefrequentlyendup

servingenterprises.Forexample,throughouttheCOVID-19pandemic,manyorganizationsbought

andintegratedconsumerwebcamsandmicrophonesforremoteworkers.Traditionalphysical

officespacesalsoincreasinglyincludesmartappliancesorsmartmonitors/TVs.Therefore,we

suggestNISTdevelopaschemethatisstraightforwardenoughtoinformindividualsyet

comprehensiveenoughtoassistdecisionmakingwithinenterprises.Asapracticalmatter,thismay

simplymeanincludingdetailaboutafewadditionalenterprise-focusedusecases,suchasthe

abilitytointegratewiththird-partysecurityproviders.

Q1.Formalandinformalprocessesandpracticesusedtosecurethesoftware

development

process

AsCrowdStrikeCEOGeorgeKurtznotedinarecentSenatetestimony,“[i]nadditiontoensuring

secure

codingpracticesandadequatecodereview,organizationsmustprotecttheirdevelopment

platformsandcoderepositoriesatleastaswellastheirenterpriseenvironment.Inpractice,this

meansthatbeyondtheothersecurityconcepts”likethreathunting,endpointdetectionand

response(EDR)technologiesaidedbyAI/ML,andextendeddetectionandresponse(XDR)
 

 

 

 

 

 

 

 

 

 

solutions,“...organizationsmustincorporatesecureimplementationofbothhardwareandsoftware,

conductarchitecturereviews,deploycodesigningviatamperresistanthardware,engagein

ongoingmonitoring,andregulartesting.Fortunately,thesecuritycommunityhasbeenfocusingon

theseissues,andwecommendtheNationalInstituteofStandardsandTechnology(NIST)fortheir

significantandongoingcontributionstothisarea.”1

Q2.Technicalcriterianeededtosupportvalidationofconsumersoftwaresecurity

assertionsthatreflectabaselinelevelofsecurepractices

Whilewecannotsuggestafullsetofcriteriaatthistime,wenotethatsomecurrenteffortstothis

end

appearoverlyconstrainedtodevicesthemselves.Amorecomprehensivedepictionwould

includeboththedeviceandsupportinginfrastructure--frequentlyacloudenvironment.Notably,

cloudbackendsmaybeamongthemostattractivepartsofIoTattacksurfacetocertaintypesof

threatactors.Therefore,cloudsecuritypostureisaparticularlyrelevantareaofinquiry.

Further,asnotedabove(“scope”)onerelevantcriteriathatmaybeoverlookedwithconsumerIoT

solutionsistheabilitytosupportorintegratewiththirdpartysecurityproviders.

Q3.Howdifferentconformityassessmentapproaches(e.g.,vendorattestation,

third-party

conformityassessment)canbeemployedinconsumersoftwarelabeling

efforts

Ingeneral,weadvocatefortheuse,whereverpossible,ofreal- ornear-realtimedepictionsof

security

posture.Attestationsandothercompliance-basedmeasurescanhelpestablishafloorfor

thesecuritymaturityofagivenvendor/provider,andthiscorrelateswithstrongersecurity

outcomes,includingbreachdetectionandremediation.However,point-in-timerepresentations

aboutsecurityhaveanumberofweaknesses,soschemesthatsupportreal-timerepresentations

arepreferred.Ultimately,effortsshouldincentivizetheimplementationofmethods,

interoperabilityoptions,andinherentsafeguardsthatstrengthenoverallsecurityforthelifetimeof

agivendevice.

III.CONCLUSION

WhileIoTsecuritybestpracticesarebecomingclearerovertime,2

securedevelopmentand

implementationpracticesinthespace,aswellastransparencymeasures,stilllagbehind.

Ultimately,IoTadoptionrateswillincreaseandattackswillcontinuetoevolve,sonowisthe

appropriatetimetostrengthensecuritypracticesandcontrols.

Theultimategoalofcreatingconsumersoftwarelabelingrequirementswillrequireamultifaceted

approach,includingleveragingtheverytechnologiesandsecurityprincipleshighlightedintheEO.

Inlightofrecentandongoingthreats,identifyingandmitigatingsoftwaresecurityvulnerabilitiesis

akeypartofachievingsuccess.

1 George

Kurtz,TestimonyonCybersecurityandSupplyChainThreats,SenateSelectCommitteeon

Intelligence(Feb.23,2021),

https://www.intelligence.senate.gov/hearings/open-hearing-hearing-hack-us-networks-foreign-adversary.

2

WhatisIoTSecurity,CrowdStrikeBlog,(Mar.18,2021),

https://www.crowdstrike.com/cybersecurity-101/internet-of-things-iot-security/.
 

 

 

 

 

IV.ABOUTCROWDSTRIKE

CrowdStrike®Inc.(Nasdaq:CRWD),aglobalcybersecurityleader,isredefiningsecurityforthe

cloud

erawithanendpointprotectionplatformbuiltfromthegrounduptostopbreaches.The

CrowdStrikeFalcon®platform’ssinglelightweight-agentarchitectureleveragescloud-scaleAIand

offersreal-timeprotectionandvisibilityacrosstheenterprise,preventingattacksonendpointson

oroffthenetwork.PoweredbytheproprietaryCrowdStrikeThreatGraph®,CrowdStrikeFalcon

correlatesover3trillionendpoint-relatedeventsperweekinrealtimefromacrosstheglobe,

fuelingoneoftheworld’smostadvanceddataplatformsforsecurity.

WithCrowdStrike,customersbenefitfrombetterprotection,betterperformanceandimmediate

time-to-value

deliveredbythecloud-nativeFalconplatform.

There’sonlyonethingtorememberaboutCrowdStrike:Westopbreaches.Learnmore:

https://www.crowdstrike.com/.

V.CONTACT

Wewouldwelcometheopportunitytodiscussthesemattersinmoredetail.Publicpolicyinquiries

should

bemadeto:

DrewBagleyCIPP/ERobertSheldon

VP&Counsel,PrivacyandCyberPolicyDirector,

PublicPolicy&Strategy

Email:policy@crowdstrike.com

©2021CrowdStrike,Inc.Allrightsreserved.CrowdStrike,thefalconlogo,CrowdStrikeFalconand

CrowdStrike

ThreatGrapharetrademarksownedbyCrowdStrike,Inc.andregisteredwiththe

UnitedStatesPatentandTrademarkOffice,andinothercountries.CrowdStrikeownsother

trademarksandservicemarks,andmayusethebrandsofthirdpartiestoidentifytheirproducts

andservices.

***