Security of our products is in our DNA, and today we’re proud to announce that Finnish Cyber Security Centre has granted the Ruuvi Gateway Finnish Cybersecurity Label. The label itself is based on ETSI-EN 303 645 which is an European standard for IoT device security. Having the Label signifies that our product and associated services meet the security requirements of modern consumer IoT devices. Previously the Label had been granted to RuuviTag sensor beacons as a standalone device, but now the entire Ruuvi product family is certified. We view security as an ongoing process which matches the process of the Label very well: there will be annual follow-up auditions to ensure that our products have stayed secure.
We had the requirements of the Label from the very start of development driving our product specification, especially the automatic firmware updates and configuration experience of the Gateway. It is often thought that security and user convenience are at odds with each other, but in this case we found that requirements of the Label drive simplicity and convenience of design. Most notable example of this is our decision to use public-key cryptography when transmitting sensitive information to the Gateway, which leads to passwordless configuration secured by cryptography running in the background.
In our experience the benefits of security-conscious development are not limited to having secure products. Secure development drives clear specification and interface definitions as well as throughout testing of the interfaces which in turn makes the interfaces reliable and well-documented. Using automated tools to scan for vulnerabilities also often highlight subtle bugs in the code and enable us to catch issues before they hit production.
The Cybersecurity Label is not only limited to security against external attacks, but also has sections with requirements for ease of use and fault tolerance. Following the guidelines on user experience leads to a product with an intuitive Just Works -feel that is expected in modern devices. We’re very happy with the ease of setting up the Gateway which does not require user pairing of Gateways and sensors.
We are thankful for the Cyber Security Centre and their team for their support on our mission to make better IoT devices.
You can read the full report here!
