480
B. Russell
firmware that runs a device can be found online and analyzed for vulnerabilities
using firmware analysis tools. Devices may also be installed in exposed locations,
leaving them open to theft. When an attacker has physical access to an IoT machine,
he or she has many methods to compromise that machine. Physical security controls
must be considered whenever an IoT system includes machines that are physically
exposed to untrusted humans.
10.3 Cyber Security Controls for IoT Systems
The selection of security controls that can mitigate the threats described in this
chapter must be made across the various layers of an IoT system. Controls are not
simply technological in nature. Process-based controls and security controls applied
to the human users of IoT systems must also be incorporated. In the following
sections, we detail cyber security controls that can be applied at discrete layers
within the IoT system (Fig. 10.2).
We begin with a framework for the secure development of a new IoT system and
then discuss specific controls that can be applied to the devices at the edge of an IoT
system, within the network layer that supports IoT systems and within the cloud
services that enable IoT features. We finish by examining security controls that can
be used to help secure the human element of any IoT system.
Fig. 10.2 Cyber security controls
B. Russell
firmware that runs a device can be found online and analyzed for vulnerabilities
using firmware analysis tools. Devices may also be installed in exposed locations,
leaving them open to theft. When an attacker has physical access to an IoT machine,
he or she has many methods to compromise that machine. Physical security controls
must be considered whenever an IoT system includes machines that are physically
exposed to untrusted humans.
10.3 Cyber Security Controls for IoT Systems
The selection of security controls that can mitigate the threats described in this
chapter must be made across the various layers of an IoT system. Controls are not
simply technological in nature. Process-based controls and security controls applied
to the human users of IoT systems must also be incorporated. In the following
sections, we detail cyber security controls that can be applied at discrete layers
within the IoT system (Fig. 10.2).
We begin with a framework for the secure development of a new IoT system and
then discuss specific controls that can be applied to the devices at the edge of an IoT
system, within the network layer that supports IoT systems and within the cloud
services that enable IoT features. We finish by examining security controls that can
be used to help secure the human element of any IoT system.
Fig. 10.2 Cyber security controls