474
B. Russell
10.5.9 Vulnerability Scanning ....................................................... 502
10.5.10 Penetration Testing ........................................................... 502
10.6 A Secure Cloud .......................................................................... 503
10.6.1 Evaluate the Security of the CSP ............................................ 504
10.6.2 Design the Cloud Service to be Resilient and Available .................... 505
10.6.3 Securely Configure the Cloud Network ..................................... 505
10.6.4 Apply Encryption to Cloud Communications ............................... 505
10.6.5 Manage Cloud Identities ..................................................... 506
10.6.6 Require Multi-Factor Cloud Authentication ................................ 506
10.6.7 Audit Cloud Services ......................................................... 506
10.6.8 Monitor the Cloud ............................................................ 506
10.6.9 Implement Cloud Identity Management ..................................... 506
10.6.10 Use Zero-Touch Provisioning ................................................ 507
10.6.11 Role-Based Access Controls ................................................. 507
10.6.12 Secure Data in the Cloud ..................................................... 508
10.6.13 Secure Web Services ......................................................... 508
10.7 Secure System Users and Administrators .............................................. 509
10.7.1 User Training ................................................................. 509
10.7.2 Administrator Training ....................................................... 509
10.7.3 Incident Response Planning .................................................. 510
10.8 Conclusion ............................................................................... 511
References ........................................................................................ 511
10.1 Introduction
In 2013, Linux.Aidra was released on the Internet. The malware automatically
identified and exploited vulnerable routers. Since then, dozens of new or derived
botnets have been discovered that prey on basic weaknesses in Internet of Things
(IoT) products. BASHLITE, Remaiten, Mirai, and others scan the Internet for open
ports and then run exploits against known vulnerabilities in connected IoT products.
This automated malware is programmed with well-known username and password
combinations that are very often left unchanged as IoT products are deployed into
networks.
Automated botnets have gained significant media attention because of the
damage that can be achieved when using them to take down Internet sites and
services. But, botnets almost never include zero-day exploits and rarely represent
the true capabilities of cyber criminals. More advanced exploits and capabilities
exist that are often kept secret until the time is right to use them. Bad actors
are even commercializing their exploits. Malware-as-a-Service, for example, now
allows less-skilled adversaries to purchase or rent exploits and tools developed by
savvy criminals. As we continue to see a risk in the use of malware-as-a-service, we
will likely see a continued rise in attempts to compromise IoT products and systems.
Effective cyber security must become a fundamental goal within all IoT products
and systems. This chapter details methods that can be used to understand and
mitigate the myriad cyber security threats faced by IoT developers and operators. We
discuss the complex threat environment that IoT systems operate within and provide
guidance for implementing cyber security measures across the core architectural
elements of an IoT system: the edge, the network, the cloud, and the user.
B. Russell
10.5.9 Vulnerability Scanning ....................................................... 502
10.5.10 Penetration Testing ........................................................... 502
10.6 A Secure Cloud .......................................................................... 503
10.6.1 Evaluate the Security of the CSP ............................................ 504
10.6.2 Design the Cloud Service to be Resilient and Available .................... 505
10.6.3 Securely Configure the Cloud Network ..................................... 505
10.6.4 Apply Encryption to Cloud Communications ............................... 505
10.6.5 Manage Cloud Identities ..................................................... 506
10.6.6 Require Multi-Factor Cloud Authentication ................................ 506
10.6.7 Audit Cloud Services ......................................................... 506
10.6.8 Monitor the Cloud ............................................................ 506
10.6.9 Implement Cloud Identity Management ..................................... 506
10.6.10 Use Zero-Touch Provisioning ................................................ 507
10.6.11 Role-Based Access Controls ................................................. 507
10.6.12 Secure Data in the Cloud ..................................................... 508
10.6.13 Secure Web Services ......................................................... 508
10.7 Secure System Users and Administrators .............................................. 509
10.7.1 User Training ................................................................. 509
10.7.2 Administrator Training ....................................................... 509
10.7.3 Incident Response Planning .................................................. 510
10.8 Conclusion ............................................................................... 511
References ........................................................................................ 511
10.1 Introduction
In 2013, Linux.Aidra was released on the Internet. The malware automatically
identified and exploited vulnerable routers. Since then, dozens of new or derived
botnets have been discovered that prey on basic weaknesses in Internet of Things
(IoT) products. BASHLITE, Remaiten, Mirai, and others scan the Internet for open
ports and then run exploits against known vulnerabilities in connected IoT products.
This automated malware is programmed with well-known username and password
combinations that are very often left unchanged as IoT products are deployed into
networks.
Automated botnets have gained significant media attention because of the
damage that can be achieved when using them to take down Internet sites and
services. But, botnets almost never include zero-day exploits and rarely represent
the true capabilities of cyber criminals. More advanced exploits and capabilities
exist that are often kept secret until the time is right to use them. Bad actors
are even commercializing their exploits. Malware-as-a-Service, for example, now
allows less-skilled adversaries to purchase or rent exploits and tools developed by
savvy criminals. As we continue to see a risk in the use of malware-as-a-service, we
will likely see a continued rise in attempts to compromise IoT products and systems.
Effective cyber security must become a fundamental goal within all IoT products
and systems. This chapter details methods that can be used to understand and
mitigate the myriad cyber security threats faced by IoT developers and operators. We
discuss the complex threat environment that IoT systems operate within and provide
guidance for implementing cyber security measures across the core architectural
elements of an IoT system: the edge, the network, the cloud, and the user.