IoT Cybersecurity Compliance & Certification

©Rödl&Partner©Rödl&Partner
PRESENTI
NEL MONDO
1
Rödl&Partner–presentation
“Internet of Things & Cybersecurity:
difficult combination”
Avv. Eugenio Bettella

2
SFSCON - FREE SOFTWARE CONFERENCE 2019
TABLE OF CONTENTS
First Part
➢ Introduction: IoT and the new cyber risk scenario.
➢ Internet of Things: definitions & benefits. The risk of cyber attacks.
Second Part
➢ Cybersecurity and IoT: statistics and importance for companies.
➢ Analysis of UE and Italian rules with reference to Cybersecurity.
Third Part
➢ Compliance for the IoT devices.
➢ The ISO certification for IoT devices. The role of the open software.
Q&A

3
INTRODUCTION
Cyberspace is a reality in which the real world is progressively
migrating, transforming the paradigm of real life for
individuals and businesses. The Internet has previously
allowed access to data at a global level and now allows
interconnection between goods that are recognized.
The new challenge on the control of data use and on the
safety in the use of interconnected devices I o T is only in its
beginning but already it is complex and it is a source of
criticality.
Companies, in fact, are becoming a constant target for
cybercriminals who, in pursuing their own purposes,
demonstrative or of simple illegal enrichment or of any other
nature, access domestic and corporate networks creating
from simple and temporary inefficiencies to serious and
irreparable financial and reputational damage
And while technology is making great progress, the law, as
always, is chasing after it.
The European Union has taken a very responsible attitude on
the subject and, in matters of T O I as well as for data
protection, intends to provide a single framework of rules for
the certification of the computer security of T O I products
and digital services, which will have to be recognized in all
Member States to gradually replace the national schemes.

4
The widespread circulation, in everyday life, of
connected devices for the most varied usages brings
inevitably new vulnerabilities from the Cybersecurity
point of view.
New challenge: related to the control of the data and
the Cybersecurity in the use of interconnected
devices (IoT).
Companies are becoming a constant target for cyber
criminals who access domestic and corporate
networks causing from simple and temporary
inefficiencies to serious and irreparable financial and
reputational damage.
New open source software can automatically and
efficiently help to search for vulnerable devices by
applying penetration testing systems.
The purpose is offering solutions to mitigate the risks
of the cyber attacks.
INTRODUCTION: IOT

5
1. INTERNET OF THINGS – PRELIMINARY OVERVIEW
➢ The Internet of Things (IoT) are defined as "objects that have their own IP address, are embedded in complex
systems and use sensors to obtain information from their environment (e.g., food products that record temperature
at every stage of the supply chain) and/or control devices to interact with the same environment (e.g. air
conditioning valves that react to the presence of people)" (first definition of IoT as provided by the Communication
of the EU Commission to the European Parliament dated June, 6, 2009).
➢ The disruptive element of the IoT lies in the fact that it allows the devices to "talk" through the Internet connection
and then provide information for rapid intervention or in the after-sales phase for the management of spare parts or
maintenance

6
1. INTERNET OF THINGS APPLICATIONS
Smart Car
New connectivity-enabled services include preventive maintenance and integration of smart speakers.
Wearable devices
The so called «wearable» are IoT devices that serve to control wealth and health. They include hi-tech
devices that can monitor our daily physical activity, such as fit trackers that everybody can put on his
wrist to check the steps or miles travelled every day, or smartwatches that are able to control our sleep,
measuring the quality and quantity of the hours we sleep every night.
Home Automation
It includes applications for security purposes (video surveillance, anti-intrusion, access management),
plant maintenance (fault detection, maintenance management) and "environment management" (air
conditioning, lighting, irrigation).
Smart Cities
Smart cities are becoming instrumented, interconnected and intelligent, i.e. they are able to collect data
in real time from sensors, integrate the collected data into a single platform accessible to the various
urban service providers, so that they can optimize the provision of these services.

7
1. INTERNET OF THINGS: CONNECTIVITY
Connectivity and data are the essence of the IoT's fuctioning:
devices and resources are equipped with electronic components,
such as sensors and softwares to acquire, filter and exchange
data. In this way, IoT creates the connection of networks,
processes and data, which are transformed into new knowledge.
Connectivity enables improvements in consumers life, business,
healthcare, mobility, cities and society through the processing of the
acquired data in Big Data.
The data transmitted through the IoT devices, providing
information on characteristics, habits, lifestyle of the user,
should be qualified as personal data with the consequent
application of the relevant compliance rules (i.e. GDPR)

8
1. INTERNET OF THINGS: THE RISK OF CYBER ATTACKS
The huge and growing number of IoT devices connected to internet offers new access points that are
the source of potential attacks against the privacy and cyber security of users and companies.
...but which are the risks of cyber security precisely ?
➢ Theft or unlawful use of
personal data acquired;
➢ Hacking of IoT devices with
the risk of data alteration;
➢ Hacking of IoT devices with
the consequent damage to
them.

9
2. IOT & CYBERSECURITY
The "perpetual connectivity" of IoT devices and the resulting increasing risk of cyber attacks are
certainly relevant issues for IoT devices producers because these risks are:
➢ relevant for guaranteeing the rights and freedoms of the natural persons involved in the
processing;
➢ relevant for sanction risks under the GDPR (and Cybersecurity rules);
➢ relevant to protect data and corporate assets;
➢ relevant for ensuring business activity and
business continuity;
➢ relevant for reputation.

10
2. CYBERSECURITY - EUROPEAN LEGAL FRAMEWORK
• Directive No 2016/1148 on the security of the Union's networks and
information systems (NIS Directive)
➢ It regulates "networks and information systems", intended as:
a) electronic communications networks,
b) interconnected or connected devices which automatically process
digital data,
c) digital data stored, processed, retrieved or transmitted by means of
networks or devices.
• REGULATION (EU) No. 2019/881 OF THE EUROPEAN PARLIAMENT AND OF
THE COUNCIL of 17 April 2019 on ENISA, the European Union Agency for
CYBERSECURITY, and the certification of cyber-security for information and
communication technologies, repealing Regulation (EU) No 526/2013
(Cybersecurity Act)

11
2. CYBERSECURITY ACT IN DETAILS
➢ Cybersecurity Act consists of two fundamental parts, one
dedicated to ENISA (European Union Agency for Cybersecurity),
providing for a more operational role in the management of a
cyberattack; the other, dedicated to the design of a homogeneous
security system between Member States, with specific regard to
IoT devices and other digital products and services.
➢ Recital 65 of Cybersecurity Act provides that: "Cyber-security
certification plays an important role in enhancing the security of
and increasing trust in ICT products, services and processes. The
digital single market, in particular the Internet of Things, can only
flourish if citizens are convinced that these products, services and
processes offer a certain level of cyber-security”.
➢ Under the Cybersecurity Act, certification schemes for the IoT will
be prepared by ENISA and formally adopted by the European
Commission through implementing acts. Once the European
certification scheme has been adopted, firms will be able to apply
for certification of their IoT devices to the appointed administrative
bodies.

12
2. CYBERSECURITY: ITALIAN LEGAL FRAMEWORK
➢ Legislative Decree no. 65/2018 implementing the NIS Directive
➢ Guidelines of July 3, 2019 outline the procedure for risk management and the
prevention and mitigation of accidents.
➢ Decree Law No. 105 of 2019 entitled "Urgent provisions on the perimeter of national
cybernetic security".
The Italian Decree

13
The Legislative Decree 105/2019 aims to ensure a more
secure procurement for those who intend to procure ICT
goods and services for use on networks, systems and
relevant services.
How could this effect small and medium companies?
The large public and private players included in the
"National Cybernetic Security Perimeter", in order to be
compliant with the regulations and thus continue to offer
essential services will in turn have to ensure that their
suppliers and their supply chain is just as solid and secure
as they are.
2. CYBERSECURITY: A DOMINO EFFECT
PresentingRödl&Partner–Firmpresentation

14
2. CYBERSECURITY in PRACTISE: WHAT DOES IT MEAN?
• Cybersecurity must prevent access both to
unauthorized users and subjects with limited access,
in order to prevent data from being copied, modified,
deleted or "ex-filtered".
• If the security of data and information is
compromised, it is not only the privacy but also the
protection of the assets that is affected.
• Cybersecurity does not apply only to data, but also to
infrastructure and everything that is connected with
the virtual world, including IoT devices.
• PREVENTION, STRATEGIES OF DEFENCE and
RECOVERY IN CASE OF CYBER ATTACKS should
have a paramount importance for companies.

15
2. CYBERSECURITY IN PRACTICE
Availability
• Ensure availability to
legitimate users
• Ensure business
continuity &
implement disaster
recovery
policies/procedures.
Confidentiality
• Data can only be
accessed by users
who are actually
entitled to it
• adoption of
appropriate
authentication
procedures and
training.
Integrity
• The ability to maintain
the veracity of data and
resources and ensure
that they are not altered
or deleted in any way.
• Examples: inappropriate
security and
authentication
policies/technologies,
software vulnerabilities.
• Mitigation: access
control (Identity/access
management), patch
management.
Resilience
• It is the capacity of a
system to absorb an
attack and reorganize
itself in order to
recover its functions,
its structure, its
internal and external
relations,
substantially
maintaining its
identity.
The security of the data transmitted by the IoT devices: the 4 qualities

16
3. CYBERSECURITY & IOT: COMPLIANCE
• IoT manufacturers must ensure regulatory compliance with
data protection regulation and must therefore implement
appropriate privacy policies and risk assessment processes to
mitigate the risk of cyber attacks against IoT devices in
accordance with the principles of "privacy by design" and
"privacy by default".
➢The principle of "privacy by design" requires that data
protection is integrated throughout the entire life cycle of the
technology, from the very first design phase to the last
distribution, use and final disposal of the device
➢ The principle of "privacy by default" requires that privacy
settings for services and products respect general data
protection principles, such as data minimization and purpose
limitation.
• In Italy and in the EU, the GDPR sanctions are applied in the
event that the processing of personal data transmitted by the
IoT device does not comply with the data protection
obligations established by GDPR.

17
3. OPEN SOFTWARE RELEVANCE FOR IOT
• In the IoT sector, especially for Home & Building
Automation applications, the software component is
strategic and thus should be reliable, easy to maintain
and, where possible, open source.
• The need to use open source software stems from the
fact that the operation of these software is usually
managed by a large community of users, voted among
other things in the continuous search for solutions to
make improvements for the same software.
• Open software is therefore a flexible tool, constantly
evolving and thus is perfectly suited to support
processes aimed at ensuring information security for
IoT devices: cyber threats are always new and different,
so even the defense tools must be immediately ready to
evolve.

18
3. CONCLUSIONS
Today the IoT device manufacturers need to start taking
cybersecurity seriously and taking measures to protect their
systems.
Vulnerability to cyber attacks remains one of the most worrying
weaknesses of the Internet of Things.
The security standard are not achieved only with well-designed
IoT devices, but it is equally important that such devices rely
on an ecosystem of constant secure protection in which open
software programs can certainly play a significant role given
their nature as flexible and always evolving programs.

CONTACTS
19
Eugenio Bettella
Managing Partner
Via F. Rismondo, 2/E
35131 Padova
Tel. +39 049 8046911
Fax +39 049 8046920
giuliana.viviano@roedl.it

©Rödl&Partner
20
Avvocati, Dottori Commercialisti, Revisori Legali e Consulenti del Lavoro
Attorneys-at-Law, Tax Consultants, Certified Public Accountants and Labour Consultancy
Rechtsanwälte, Steuerberater, Wirtschaftsprüfer, Arbeitsrechtsberater
Milano
Largo Donegani, 2
20121 (MI)
Tel.: +39-02-6328841
Fax: +39-02-63288420
info@roedl.it
Padova
Via F. Rismondo, 2/E
35131 (PD)
Tel.: +39-049-804 6911
Fax: +39-049-8046920
padova@roedl.it
Roma
P.zza S.Anastasia, 7
00186 (RM)
Tel.: +39-06-96701270
Fax: +39-06-3223394
roma@roedl.it
Bolzano
P.zza Walther- von- der- Vogelweide 8
39100 (BZ)
Tel.: +39-0471-1943200
Fax: +39-0471-1943220
bozen@roedl.it

IoT Cybersecurity Compliance & Certification

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to IoT Cybersecurity Compliance & Certification

Similar to IoT Cybersecurity Compliance & Certification (20)

More from South Tyrol Free Software Conference

More from South Tyrol Free Software Conference (20)

Recently uploaded

Recently uploaded (20)

IoT Cybersecurity Compliance & Certification