The EU Agency for Cybersecurity (ENISA) has released guidance on securing the IoT supply chain. Connected devices have long been recognised as both a boon and a liability: the ENISA guidance is squarely aimed at securing supply chain integrity and mitigating the risks of exposure to third parties with a weak(er) security posture.

What is particularly interesting is the focus on the risks associated with the manufacture of the physical product. Cyber has historically had a fractious relationship with physical risk (is data tangible property? is physical damage from a cyber attack a material consideration?). The ENISA guidance is very clear that IoT devices are subject to a blend of physical threats as well as all the traditional code-based risks. It flags the exposures generated by assembly line sabotage, tamper-proof casing limitations and magnetic attacks. They sit alongside the traditional threats of IP theft, network compromise and patching vulnerabilities.

It's refreshing to see a risk assessment that fuses both the tangible with the intangible. The physical exposure to the digital should properly remain a consideration.