496
B. Russell
Use Geofencing Systems can be configured to track IoT device locations and take
actions when a device leaves an authorized location. For example, by applying
Global Positioning Satellite (GPS) tracking to an IoT device, alerts can be triggered
when the device leaves a configured boundary. Devices can also be configured to
automatically deactivate services upon leaving a geofenced boundary.
Establish Time-of-Use Time-of-use restrictions can be applied to IoT machines
to restrict access to the machine outside of a configured time window, or for the
machine to interact with other machines or system services.
10.4.6 Harden Network Services
Harden one of the primary entry points into IoT devices and systems. Disable
all services on IoT devices that are not explicitly required by your applications.
Do not use network services that are known-vulnerable. Instead design devices
to use more secure network services that require authentication and can support
encrypted communications. Common services that should be avoided when possible
include:
• Telnet which operates on port 23. Telnet is a well-known port targeted by many
automated malware variants include Mirai.
• File Transfer Protocol (FTP) which operates on port 21. FTP allows for insecure
data transfers.
• Universal Plug and Play (UPnP) supports network discovery of devices.
• Server Message Block (SMB) operates on ports 139 and 445. It supports file
sharing.
Other protocols and services can be implemented within your device; however,
each service should be configured securely.
Secure Shell (SSH) Access Secure access to the SSH service. Require certificatebased authentication. Do not allow log-in over SSH using the root account.
X-Windows Many IoT machines do not require a Graphical User Interface (GUI).
Although most RTOS operate as headless implementations, some IoT machines do
require the configuration of a GUI. Depending on your use case, ensure that Xwindows is disabled if you do not require user interaction with a GUI.
Network Time Protocol (NTP) Without a common time reference, correlating
activities occurring across multiple points within a system is difficult. Configure
IoT machines to use the network time protocol (NTP) to synchronize on a standard
time reference.
B. Russell
Use Geofencing Systems can be configured to track IoT device locations and take
actions when a device leaves an authorized location. For example, by applying
Global Positioning Satellite (GPS) tracking to an IoT device, alerts can be triggered
when the device leaves a configured boundary. Devices can also be configured to
automatically deactivate services upon leaving a geofenced boundary.
Establish Time-of-Use Time-of-use restrictions can be applied to IoT machines
to restrict access to the machine outside of a configured time window, or for the
machine to interact with other machines or system services.
10.4.6 Harden Network Services
Harden one of the primary entry points into IoT devices and systems. Disable
all services on IoT devices that are not explicitly required by your applications.
Do not use network services that are known-vulnerable. Instead design devices
to use more secure network services that require authentication and can support
encrypted communications. Common services that should be avoided when possible
include:
• Telnet which operates on port 23. Telnet is a well-known port targeted by many
automated malware variants include Mirai.
• File Transfer Protocol (FTP) which operates on port 21. FTP allows for insecure
data transfers.
• Universal Plug and Play (UPnP) supports network discovery of devices.
• Server Message Block (SMB) operates on ports 139 and 445. It supports file
sharing.
Other protocols and services can be implemented within your device; however,
each service should be configured securely.
Secure Shell (SSH) Access Secure access to the SSH service. Require certificatebased authentication. Do not allow log-in over SSH using the root account.
X-Windows Many IoT machines do not require a Graphical User Interface (GUI).
Although most RTOS operate as headless implementations, some IoT machines do
require the configuration of a GUI. Depending on your use case, ensure that Xwindows is disabled if you do not require user interaction with a GUI.
Network Time Protocol (NTP) Without a common time reference, correlating
activities occurring across multiple points within a system is difficult. Configure
IoT machines to use the network time protocol (NTP) to synchronize on a standard
time reference.