10 IoT Cyber Security
499
10.5.3 Implement Zero-Trust/Software-Defined Perimeter
Zero-trust configurations allow system owners to restrict access at the network layer.
Machine, users and even applications authenticate themselves to the network prior to
gaining access. Once access is granted, these users, applications, and machines are
only provided the privileges needed to accomplish their authorized activities. This
least-concept model of network access is useful to restrict access to the enterprise
should a machine be compromised.
10.5.4 Protect the Perimeter
Even with the concept of zero-trust, security controls that protect the perimeter
should still be implemented within an IoT system. Firewalls have been around a long
time. Firewalls Access Control Lists (ACLs) can be configured to restrict access
across a perimeter and offer capabilities such as threat management and virtual
private networking (VPN). Forward firewall log data to a Security Information Event
Management (SIEM) system for correlation and security analysis.
Intrusion Detection and Prevention systems (IDS/IPS) also play a vital role in
network security. IDS/IPS monitor the network and report on potential security
issues. An IPS can also be configured to block unauthorized connections. Place
IDS sensors at strategic points within the network architecture. An example of an
open source IDS is snort [24].
10.5.5 Secure Discovery Services
A quick look at a site such as Shodan [25] shows how easy it can be to identify
IoT machines configured with various protocols. Many of these protocols provide
discovery services can be useful for dynamic configuration of networks, but also
enable easy reconnaissance efforts by potential attackers. Disable discovery services
or at a minimum require authenticated access to discovery services within networks.
10.5.6 Implement Asset Management
One of the most valuable cyber security measures to apply to a network is to
implement an asset tracking program. Configuration management tools should be
used to track all hardware and software used within a network. Strict change control
procedures should also be implemented to ensure that unknown devices and services
are not installed on the network. This basic security measure will provide the data
499
10.5.3 Implement Zero-Trust/Software-Defined Perimeter
Zero-trust configurations allow system owners to restrict access at the network layer.
Machine, users and even applications authenticate themselves to the network prior to
gaining access. Once access is granted, these users, applications, and machines are
only provided the privileges needed to accomplish their authorized activities. This
least-concept model of network access is useful to restrict access to the enterprise
should a machine be compromised.
10.5.4 Protect the Perimeter
Even with the concept of zero-trust, security controls that protect the perimeter
should still be implemented within an IoT system. Firewalls have been around a long
time. Firewalls Access Control Lists (ACLs) can be configured to restrict access
across a perimeter and offer capabilities such as threat management and virtual
private networking (VPN). Forward firewall log data to a Security Information Event
Management (SIEM) system for correlation and security analysis.
Intrusion Detection and Prevention systems (IDS/IPS) also play a vital role in
network security. IDS/IPS monitor the network and report on potential security
issues. An IPS can also be configured to block unauthorized connections. Place
IDS sensors at strategic points within the network architecture. An example of an
open source IDS is snort [24].
10.5.5 Secure Discovery Services
A quick look at a site such as Shodan [25] shows how easy it can be to identify
IoT machines configured with various protocols. Many of these protocols provide
discovery services can be useful for dynamic configuration of networks, but also
enable easy reconnaissance efforts by potential attackers. Disable discovery services
or at a minimum require authenticated access to discovery services within networks.
10.5.6 Implement Asset Management
One of the most valuable cyber security measures to apply to a network is to
implement an asset tracking program. Configuration management tools should be
used to track all hardware and software used within a network. Strict change control
procedures should also be implemented to ensure that unknown devices and services
are not installed on the network. This basic security measure will provide the data