500
B. Russell
necessary to better understand the threat profile of an IoT system. This includes
tracking of third-party libraries installed within each IoT product to allow tracking
of patches associated with not only the devices but also the subcomponents used
within each of the devices.
10.5.7 Implement Vulnerability Tracking
Your networks are populated with many devices and software. Each exposes their
own potential vulnerabilities. These vulnerabilities are found over time, by the
research community. As vulnerabilities are identified, vendors implement patches
to resolve the vulnerabilities. If system administrators do not patch software, then
the software remains exposed to those vulnerabilities. Time is of the essence here;
once a vulnerability is known, exploits begin being crafted in the wild. Keep track
of vulnerabilities. Monitor sources such as MITREs Common Vulnerabilities and
Exposures (CVE) which publishes vulnerabilities through the National Vulnerability Database (NVD) [26]. Also, use the Common Vulnerability Scoring System
(CVSS) which assigns ratings for IT vulnerabilities.
Many industries have Information Sharing and Analysis Centers (ISACs) that
share information on attacks.
10.5.8 Audit and Monitoring
Automated malware can wreak havoc on an IoT system. Task network security tools
to search for new botnet activity and immediately remove infected IoT devices upon
detection. Many well-known botnets use telnet to spread so monitor for activity
on ports 23 and 2323. Botnets such as Reaper, Mirai, IoTroop, and Satori can
spread on many other ports, including 21 (FTP), 80 (http), and ephemeral ports
such as 37215. Also monitor for Command and Control (C2C) communications
that enable coordinated use of botnets. For example, JenX uses port 127 for C2C
communications.
System designers should also plan for monitoring of their network of IoT
devices and services. There are, however, many challenges associated with this.
For example, some IoT devices may not generate any security audit logs. Other IoT
devices typically do not support formats such as syslog and may require custom
connectors. In addition, gaining timely access to audit logs from remotely deployed
and RF-based IoT devices may provide difficult. For example, devices may not
be reachable over a low-bandwidth RF link or may only wake during times of
operation. Finally, confidence in the integrity of audit logs collected from IoT
devices may be limited given potential lack of cryptographic controls.
B. Russell
necessary to better understand the threat profile of an IoT system. This includes
tracking of third-party libraries installed within each IoT product to allow tracking
of patches associated with not only the devices but also the subcomponents used
within each of the devices.
10.5.7 Implement Vulnerability Tracking
Your networks are populated with many devices and software. Each exposes their
own potential vulnerabilities. These vulnerabilities are found over time, by the
research community. As vulnerabilities are identified, vendors implement patches
to resolve the vulnerabilities. If system administrators do not patch software, then
the software remains exposed to those vulnerabilities. Time is of the essence here;
once a vulnerability is known, exploits begin being crafted in the wild. Keep track
of vulnerabilities. Monitor sources such as MITREs Common Vulnerabilities and
Exposures (CVE) which publishes vulnerabilities through the National Vulnerability Database (NVD) [26]. Also, use the Common Vulnerability Scoring System
(CVSS) which assigns ratings for IT vulnerabilities.
Many industries have Information Sharing and Analysis Centers (ISACs) that
share information on attacks.
10.5.8 Audit and Monitoring
Automated malware can wreak havoc on an IoT system. Task network security tools
to search for new botnet activity and immediately remove infected IoT devices upon
detection. Many well-known botnets use telnet to spread so monitor for activity
on ports 23 and 2323. Botnets such as Reaper, Mirai, IoTroop, and Satori can
spread on many other ports, including 21 (FTP), 80 (http), and ephemeral ports
such as 37215. Also monitor for Command and Control (C2C) communications
that enable coordinated use of botnets. For example, JenX uses port 127 for C2C
communications.
System designers should also plan for monitoring of their network of IoT
devices and services. There are, however, many challenges associated with this.
For example, some IoT devices may not generate any security audit logs. Other IoT
devices typically do not support formats such as syslog and may require custom
connectors. In addition, gaining timely access to audit logs from remotely deployed
and RF-based IoT devices may provide difficult. For example, devices may not
be reachable over a low-bandwidth RF link or may only wake during times of
operation. Finally, confidence in the integrity of audit logs collected from IoT
devices may be limited given potential lack of cryptographic controls.