484
B. Russell
programming, for example, is a valuable cyber security tool. Teams can rotate
security-aware developers with the rest of the development team to instill that
awareness across the team over time. The process of pair programming also has
additional benefits. Higher quality code can be developed given a second pair of
eyes. Also, skills can be shared and learned across different members of the team to
eliminate single points of failure.
Each development team should also codify a set of secure coding guidelines.
OWASP provides a useful Secure Coding Cheat Sheet that can be used as a template
to customize your own secure coding guidelines [7]. In addition to establishing
secure coding guidelines, make sure to incorporate peer reviews into your process.
This can be handled organically when pair programming is used, but at a minimum
ensure that peer reviews occur each sprint.
Secure configuration management (CM) practices must also be put in place
for IoT system development. Ensure that your CM tool is locked down to allow
only authorized access. Do not embed API keys directly in code – instead use
configuration files that can be updated separately from the code. Make sure that
critical Secure Shell (SSH) keys that provide administrative access to cloud servers
are accounted for and only provided to authorized users. Keep an eye out for any
sensitive data that may be posted to public repositories.
Do not forget the need to provide training to your development teams. Organizations such as SAFECode and SANS provide secure development training
courses that can provide required skills to the development team. SANS also offers
certifications such as the GIAC Secure Software Programmer (GSSP)-Java and
GSSP-.NET certifications. Additionally, have your development teams review best
practices from industry organizations to gain a better understanding of the latest
recommendations for securing connected products. Table 10.2 provides a listing of
some well-written guidance documents that can provide valuable information for
security teams.
Table 10.2 References for industry best practices
Industry guidance
Applicability
Available at
IoT Security Foundation
(IoTSF) IoT Security
Framework
Enterprise IoT
systems
content/uploads/2016/12/IoT-SecurityCompliance-Framework.pdf
European Network and
Information Security Agency
(ENISA) Baseline Security
Recommendations for IoT
Enterprise IoT
systems
https://www.enisa.europa.eu/publications/
baseline-security-recommendations-foriot
Cloud Security Alliance
(CSA) Future Proofing the
Connected World
IoT Machine
Development
https://downloads.cloudsecurityalliance.
org/assets/research/internet-of-things/
future-proofing-the-connected-world.pdf
OWASP/CSA Secure Medical
Devices IoT Deployment
Deployment of
Medical IoT
devices
https://downloads.cloudsecurityalliance.
org/assets/research/owasp/OWASP_
Secure_Medical_Devices_Deployment_
Standard_7.18.18.pdf
B. Russell
programming, for example, is a valuable cyber security tool. Teams can rotate
security-aware developers with the rest of the development team to instill that
awareness across the team over time. The process of pair programming also has
additional benefits. Higher quality code can be developed given a second pair of
eyes. Also, skills can be shared and learned across different members of the team to
eliminate single points of failure.
Each development team should also codify a set of secure coding guidelines.
OWASP provides a useful Secure Coding Cheat Sheet that can be used as a template
to customize your own secure coding guidelines [7]. In addition to establishing
secure coding guidelines, make sure to incorporate peer reviews into your process.
This can be handled organically when pair programming is used, but at a minimum
ensure that peer reviews occur each sprint.
Secure configuration management (CM) practices must also be put in place
for IoT system development. Ensure that your CM tool is locked down to allow
only authorized access. Do not embed API keys directly in code – instead use
configuration files that can be updated separately from the code. Make sure that
critical Secure Shell (SSH) keys that provide administrative access to cloud servers
are accounted for and only provided to authorized users. Keep an eye out for any
sensitive data that may be posted to public repositories.
Do not forget the need to provide training to your development teams. Organizations such as SAFECode and SANS provide secure development training
courses that can provide required skills to the development team. SANS also offers
certifications such as the GIAC Secure Software Programmer (GSSP)-Java and
GSSP-.NET certifications. Additionally, have your development teams review best
practices from industry organizations to gain a better understanding of the latest
recommendations for securing connected products. Table 10.2 provides a listing of
some well-written guidance documents that can provide valuable information for
security teams.
Table 10.2 References for industry best practices
Industry guidance
Applicability
Available at
IoT Security Foundation
(IoTSF) IoT Security
Framework
Enterprise IoT
systems
content/uploads/2016/12/IoT-SecurityCompliance-Framework.pdf
European Network and
Information Security Agency
(ENISA) Baseline Security
Recommendations for IoT
Enterprise IoT
systems
https://www.enisa.europa.eu/publications/
baseline-security-recommendations-foriot
Cloud Security Alliance
(CSA) Future Proofing the
Connected World
IoT Machine
Development
https://downloads.cloudsecurityalliance.
org/assets/research/internet-of-things/
future-proofing-the-connected-world.pdf
OWASP/CSA Secure Medical
Devices IoT Deployment
Deployment of
Medical IoT
devices
https://downloads.cloudsecurityalliance.
org/assets/research/owasp/OWASP_
Secure_Medical_Devices_Deployment_
Standard_7.18.18.pdf