Chapter 10
IoT Cyber Security
Brian Russell
For happiness one needs security, but joy can spring like a
flower even from the cliffs of despair.
Anne Morrow Lindbergh
Contents
10.1 Introduction .............................................................................. 474
10.2 A Complex Threat Environment ........................................................ 475
10.2.1 Threat Actors and Risk Likelihood .......................................... 477
10.2.2 Threat Types .................................................................. 477
10.3 Cyber Security Controls for IoT Systems .............................................. 480
10.3.1 Establishing a Secure IoT System Development Methodology ............ 481
10.3.2 Integrating Safety and Security Engineering ................................ 487
10.3.3 Safeguarding Stakeholder Privacy ........................................... 488
10.4 Securing the IoT Edge................................................................... 488
10.4.1 Use a Hardware Security Element to Support Trusted Operations ......... 490
10.4.2 Configure a Secure Real-Time Operating System .......................... 491
10.4.3 Implement Physical Security Controls ...................................... 492
10.4.4 Deploy Confidentiality Protections .......................................... 493
10.4.5 Implement Strong Authentication and Access Controls .................... 495
10.4.6 Harden Network Services .................................................... 496
10.4.7 Implement Logging and Behavioral Analytics .............................. 497
10.4.8 Implement Framework Security ............................................. 497
10.5 A Secure Network ....................................................................... 498
10.5.1 Secure Wireless Sensor Network (WSN) Configuration ................... 498
10.5.2 Segment the Network......................................................... 498
10.5.3 Implement Zero-Trust/Software-Defined Perimeter ........................ 499
10.5.4 Protect the Perimeter ......................................................... 499
10.5.5 Secure Discovery Services ................................................... 499
10.5.6 Implement Asset Management ............................................... 499
10.5.7 Implement Vulnerability Tracking ........................................... 500
10.5.8 Audit and Monitoring ........................................................ 500
B. Russell ()
TrustThink, LLC, San Diego, CA, USA
e-mail: russell_brian@trustthink.net
© Springer Nature Switzerland AG 2020
F. Firouzi et al. (eds.), Intelligent Internet of Things,
https://doi.org/10.1007/978-3-030-30367-9_10
473
IoT Cyber Security
Brian Russell
For happiness one needs security, but joy can spring like a
flower even from the cliffs of despair.
Anne Morrow Lindbergh
Contents
10.1 Introduction .............................................................................. 474
10.2 A Complex Threat Environment ........................................................ 475
10.2.1 Threat Actors and Risk Likelihood .......................................... 477
10.2.2 Threat Types .................................................................. 477
10.3 Cyber Security Controls for IoT Systems .............................................. 480
10.3.1 Establishing a Secure IoT System Development Methodology ............ 481
10.3.2 Integrating Safety and Security Engineering ................................ 487
10.3.3 Safeguarding Stakeholder Privacy ........................................... 488
10.4 Securing the IoT Edge................................................................... 488
10.4.1 Use a Hardware Security Element to Support Trusted Operations ......... 490
10.4.2 Configure a Secure Real-Time Operating System .......................... 491
10.4.3 Implement Physical Security Controls ...................................... 492
10.4.4 Deploy Confidentiality Protections .......................................... 493
10.4.5 Implement Strong Authentication and Access Controls .................... 495
10.4.6 Harden Network Services .................................................... 496
10.4.7 Implement Logging and Behavioral Analytics .............................. 497
10.4.8 Implement Framework Security ............................................. 497
10.5 A Secure Network ....................................................................... 498
10.5.1 Secure Wireless Sensor Network (WSN) Configuration ................... 498
10.5.2 Segment the Network......................................................... 498
10.5.3 Implement Zero-Trust/Software-Defined Perimeter ........................ 499
10.5.4 Protect the Perimeter ......................................................... 499
10.5.5 Secure Discovery Services ................................................... 499
10.5.6 Implement Asset Management ............................................... 499
10.5.7 Implement Vulnerability Tracking ........................................... 500
10.5.8 Audit and Monitoring ........................................................ 500
B. Russell ()
TrustThink, LLC, San Diego, CA, USA
e-mail: russell_brian@trustthink.net
© Springer Nature Switzerland AG 2020
F. Firouzi et al. (eds.), Intelligent Internet of Things,
https://doi.org/10.1007/978-3-030-30367-9_10
473