10 IoT Cyber Security
501
An auditing and monitoring framework should collect security-relevant events.
These might include (source: Russell, VanDuren, PACKT Publishing, Practical IoT
Security):
• Device not reachable: A device that is disconnected from the network may have
been compromised and brought offline or suffering from a denial of service
attack.
• Time-based anomalies: Determine standard time-of-use characteristics for the
system and monitor for use outside of these time restrictions.
• Spikes in velocity: Increased velocity can mean that a device has been hijacked
by automated malware and is being used in botnet activity.
• New protocols on the network: If seeing abnormal protocols/ports are being used,
this may indicate repurposing of an IoT machine for nefarious purposes.
• Authentication anomalies: Repeated authentication failures may mean that an
IoT machine or service has been targeted by a malicious actor.
• Attempted elevation of privilege: Attempts to increase privilege by accessing the
root account or attempting sudo access may indicate that the machine has been
compromised.
• Drops in velocity: A drop in velocity may indicate network congestion or
attempted denial of service against the IoT machine or service.
• Rapid change in device physical state. A rapidly increased Central Processing
Unit (CPU) usage may mean that an attempt to drain the device battery is being
conducted by executing multiple new applications or that the device is operating
outside of standard parameters.
• Communications with unexpected destinations: Most IoT machines are configured to communicate with a limited number of devices and gateways. When
communication from an edge machine to a non-normal service or device is
detected, it may indicate attempted lateral movement through the system. Even
if these attempts are low in volume they should be investigated.
• Unexpected audit results: Logging should be enabled on all computers and
machines in the system. These logs must be audited on a regular basis. Abnormal
audit findings may indicate attempted or successful compromise.
• Purged audit trails: A deleted audit log may be indicative of a trusted insider
attempting to cover his or her tracks. Modification or deletion of audit logs should
be restricted to an “audit group” but even members of this trusted group must be
monitored for malicious activity.
• Sweeping for topics: Topic sweeping using publish/subscribe protocols may be
indicative of a user attempting to gain access to data he or she is not authorized
to view.
501
An auditing and monitoring framework should collect security-relevant events.
These might include (source: Russell, VanDuren, PACKT Publishing, Practical IoT
Security):
• Device not reachable: A device that is disconnected from the network may have
been compromised and brought offline or suffering from a denial of service
attack.
• Time-based anomalies: Determine standard time-of-use characteristics for the
system and monitor for use outside of these time restrictions.
• Spikes in velocity: Increased velocity can mean that a device has been hijacked
by automated malware and is being used in botnet activity.
• New protocols on the network: If seeing abnormal protocols/ports are being used,
this may indicate repurposing of an IoT machine for nefarious purposes.
• Authentication anomalies: Repeated authentication failures may mean that an
IoT machine or service has been targeted by a malicious actor.
• Attempted elevation of privilege: Attempts to increase privilege by accessing the
root account or attempting sudo access may indicate that the machine has been
compromised.
• Drops in velocity: A drop in velocity may indicate network congestion or
attempted denial of service against the IoT machine or service.
• Rapid change in device physical state. A rapidly increased Central Processing
Unit (CPU) usage may mean that an attempt to drain the device battery is being
conducted by executing multiple new applications or that the device is operating
outside of standard parameters.
• Communications with unexpected destinations: Most IoT machines are configured to communicate with a limited number of devices and gateways. When
communication from an edge machine to a non-normal service or device is
detected, it may indicate attempted lateral movement through the system. Even
if these attempts are low in volume they should be investigated.
• Unexpected audit results: Logging should be enabled on all computers and
machines in the system. These logs must be audited on a regular basis. Abnormal
audit findings may indicate attempted or successful compromise.
• Purged audit trails: A deleted audit log may be indicative of a trusted insider
attempting to cover his or her tracks. Modification or deletion of audit logs should
be restricted to an “audit group” but even members of this trusted group must be
monitored for malicious activity.
• Sweeping for topics: Topic sweeping using publish/subscribe protocols may be
indicative of a user attempting to gain access to data he or she is not authorized
to view.