How to manage third-party device security?

I’m glad to see the first stand-alone cyber security legislation passing in to law today in Australia. The regulations around device security will be fascinating to observe as there are often conflicting incentives at work.

I know first hand how difficult it is to ensure third-party devices meet security requirements. I was responsible for ensuring that third-party devices meet Amazon’s high security bar before being allowed to onboard to Prime Video. This included TVs, set-top boxes, sound bars, and other “living room devices”.

Many device companies have the “pile it high, sell it cheap” mentality, where they are operating on short product lifecycles and small margins. They put out a new product every few months and even getting them to support their own devices with security updates past a year or two after production is difficult.

Such manufacturers are notoriously parsimonious when it comes to spending on security. For example, will every device need a hardware pentest? That alone could eat up all profits on some long-tail devices.

If the manufacturer only has to offer a statement of compliance to certain security requirements, can we trust them to be honest? And, if the devices are not tested, how can the regulations be enforced?

It will be interesting to see how Australian Government handles these questions.