10 IoT Cyber Security
495
10.4.5 Implement Strong Authentication and Access Controls
Cryptography also supports authentication. Require authentication for access to all
services and ports. Establish good password processes. Do not hard-code passwords
into the device and do not provision duplicate identities or passwords across multiple
devices. Require password changes on a quarterly basis.
When possible, use certificates as an authentication method instead of passwords.
When managed properly, certificates provide a higher degree of assurance that
the authentication token has not been compromised. A private key is used to
authenticate and the associated public key stored in a Certificate Authority (CA)
provisioned certificate “vouches” for the signer. Keys and certificates are used for a
variety of processes across an IoT ecosystem as detailed in Table 10.3.
10.4.5.1 Authorization and Access Control
Access within an IoT system can be further secured by implementing authorization
and access controls. Define roles to limit access to IoT devices. For example, assign
a role to devices that categorizes them as either privileged or standard. Additionally,
assign anyone that accesses a device with a role: either as a user or administrator.
Implement the concept of Least Privilege Adopt the concept of least privilege
within the system and on the device. Limit the applications that run as root. For
example, do not run network services such as web servers as root. Further, disable
the root password. Users that require administration access to the device should
instead use sudo. Using sudo allows an audit trail to be created and attributed
directly to the user. With root login, it is difficult to attribute actions to a specific user.
Table 10.3 Authentication and access controls for devices/software
Device/software
Key/certificate options
Discussion
IoT
Devices/Sensors
None
Symmetric Keys
Raw Public/Private
Keys
Certificates and key pair
Code Signing
Certificates
Many existing sensors do not have the
capability to support encrypted
communication and therefore would not be
provisioned with key material. Certificates
can also be used by machines and users to
authenticate to web servers, applications and
network services.
Web Servers
TLS Certificates
TLS Certificates are used by clients to verify
that the web server is authentic and to
support encryption of data traffic between
clients and server
Mobile Applications Code Signing
Certificates
Code signing certificates support secure
software updates
Application
Software
Code Signing
Certificates
Code signing certificates support secure
software updates
495
10.4.5 Implement Strong Authentication and Access Controls
Cryptography also supports authentication. Require authentication for access to all
services and ports. Establish good password processes. Do not hard-code passwords
into the device and do not provision duplicate identities or passwords across multiple
devices. Require password changes on a quarterly basis.
When possible, use certificates as an authentication method instead of passwords.
When managed properly, certificates provide a higher degree of assurance that
the authentication token has not been compromised. A private key is used to
authenticate and the associated public key stored in a Certificate Authority (CA)
provisioned certificate “vouches” for the signer. Keys and certificates are used for a
variety of processes across an IoT ecosystem as detailed in Table 10.3.
10.4.5.1 Authorization and Access Control
Access within an IoT system can be further secured by implementing authorization
and access controls. Define roles to limit access to IoT devices. For example, assign
a role to devices that categorizes them as either privileged or standard. Additionally,
assign anyone that accesses a device with a role: either as a user or administrator.
Implement the concept of Least Privilege Adopt the concept of least privilege
within the system and on the device. Limit the applications that run as root. For
example, do not run network services such as web servers as root. Further, disable
the root password. Users that require administration access to the device should
instead use sudo. Using sudo allows an audit trail to be created and attributed
directly to the user. With root login, it is difficult to attribute actions to a specific user.
Table 10.3 Authentication and access controls for devices/software
Device/software
Key/certificate options
Discussion
IoT
Devices/Sensors
None
Symmetric Keys
Raw Public/Private
Keys
Certificates and key pair
Code Signing
Certificates
Many existing sensors do not have the
capability to support encrypted
communication and therefore would not be
provisioned with key material. Certificates
can also be used by machines and users to
authenticate to web servers, applications and
network services.
Web Servers
TLS Certificates
TLS Certificates are used by clients to verify
that the web server is authentic and to
support encryption of data traffic between
clients and server
Mobile Applications Code Signing
Certificates
Code signing certificates support secure
software updates
Application
Software
Code Signing
Certificates
Code signing certificates support secure
software updates