10 IoT Cyber Security
497
10.4.7 Implement Logging and Behavioral Analytics
Logging allows system administrators to have visibility into the actions occurring
within IoT machines. Enable logging on IoT machines and configure log files to be
automatically transmitted to an aggregation point. This could be a local gateway or
the cloud. Not all devices support complex auditing and logging, however. When
this is the case, use behavioral analytics to identify anomalies in operation. For
example, look for use of unexpected wireless or messaging protocols being used by
the device or unexpected message sequences.
10.4.8 Implement Framework Security
IoT machines can be developed using common frameworks and platforms. This
allows machines to inherit security controls from that framework and enables
interoperability across device types. Take advantage of the various security services
offered by these frameworks.
Onboarding By provisioning an initial set of credentials to IoT machines, administrators can securely bootstrap those machines into the operational environment.
Onboarding provides the initial set of device credentials which can be transitioned
to operational device credentials, for example, by wrapping an operational key pair
in the original device credential (e.g., a bootstrap key).
Configuration Management Frameworks/platforms provide simple UIs and APIs
that allow a system administrator to configure the operational details of a device or
set of devices. This includes configuration items such as passwords, device names
or even the ability to quickly reset devices.
Asset Management Frameworks/Platforms may provide the ability for a
user/administrator to track IoT assets within a system. This is enabled through
APIs that support services such as geolocation as well as maintenance of a device
hardware and software profile (e.g., versions, third-party libraries).
Discovery Frameworks/platforms often support secure discovery services. This
enables IoT devices to find peers or locate appropriate services in the cloud.
Secure Connections This may include out-of-the-box support of cryptographic
libraries that enable protocols and algorithms for secure data at rest and data in
transit, for example, DTLS and TLS.
Cloud Gateways Frameworks/platforms often provide cloud gateways that IoT
devices can communicate with securely, providing a link between a local network
and the cloud to support global interactions.
497
10.4.7 Implement Logging and Behavioral Analytics
Logging allows system administrators to have visibility into the actions occurring
within IoT machines. Enable logging on IoT machines and configure log files to be
automatically transmitted to an aggregation point. This could be a local gateway or
the cloud. Not all devices support complex auditing and logging, however. When
this is the case, use behavioral analytics to identify anomalies in operation. For
example, look for use of unexpected wireless or messaging protocols being used by
the device or unexpected message sequences.
10.4.8 Implement Framework Security
IoT machines can be developed using common frameworks and platforms. This
allows machines to inherit security controls from that framework and enables
interoperability across device types. Take advantage of the various security services
offered by these frameworks.
Onboarding By provisioning an initial set of credentials to IoT machines, administrators can securely bootstrap those machines into the operational environment.
Onboarding provides the initial set of device credentials which can be transitioned
to operational device credentials, for example, by wrapping an operational key pair
in the original device credential (e.g., a bootstrap key).
Configuration Management Frameworks/platforms provide simple UIs and APIs
that allow a system administrator to configure the operational details of a device or
set of devices. This includes configuration items such as passwords, device names
or even the ability to quickly reset devices.
Asset Management Frameworks/Platforms may provide the ability for a
user/administrator to track IoT assets within a system. This is enabled through
APIs that support services such as geolocation as well as maintenance of a device
hardware and software profile (e.g., versions, third-party libraries).
Discovery Frameworks/platforms often support secure discovery services. This
enables IoT devices to find peers or locate appropriate services in the cloud.
Secure Connections This may include out-of-the-box support of cryptographic
libraries that enable protocols and algorithms for secure data at rest and data in
transit, for example, DTLS and TLS.
Cloud Gateways Frameworks/platforms often provide cloud gateways that IoT
devices can communicate with securely, providing a link between a local network
and the cloud to support global interactions.