504
B. Russell
The Cloud also serves as an integration point for edge machines and gateways.
Multi-protocol interfaces support connectivity from the edge. These interfaces must
be authenticated and encrypted. Standard interfaces from the edge to cloud include
HTTP, MQTT, and AMQP, although custom interfaces can be implemented as
well.
• HTTP: Encrypt all HTTP connections using Transport Layer Security (TLS) 1.2
or later. Use certificates to authenticate TLS connections.
• MQTT: Encrypt and authenticate MQTT communications using TLS 1.2 or later
as well. MQTT communications must ensure that the native username/password
field is encrypted and never sent in cleartext.
• CoAP: Secure UDP-based communications such as CoAP using DTLS.
There are many threats that must be guarded against within the cloud. For
example, most CSPs provide an identity registry that stores the identifies and
configurations of devices connected to the cloud. Amazon Web Services (AWS)
terms these “Thing Shadows.” Proper access controls must be applied to ensure that
unauthorized access to these configuration repositories is not allowed. Similarly,
access to keys must be restricted within the cloud. The use of Hardware Security
Modules (HSMs) in the cloud is often warranted. Unauthorized database access
must also be guarded against.
There are a number of recommendations listed here to lock down an IoT cloud.
Some of these make use of capabilities offered directly by a CSP and others require
the use of third party processes and tools.
10.6.1 Evaluate the Security of the CSP
Each CSP implements its own security architecture and it can be difficult to
objectively evaluate the security state of each provider. To aid in this evaluation,
download and review the Cloud Security Alliance (CSA) Cloud Controls Matrix
(CCM) which provides a set of evaluation criteria to methodically review the
security state of a CSP [29]. This registry contains self-assessments and thirdparty assessment results covering dozens of CSPs. When choosing a CSP to host
IoT system applications, review these assessment results and make comparisons
within the evaluation process to ensure selection of an optimal CSP partner. Once
selected, work with the CSP to establish Service Level Agreements (SLAs) that
detail minimum service levels and include penalties when a CSP does not meet
minimum availability or performance metrics.
B. Russell
The Cloud also serves as an integration point for edge machines and gateways.
Multi-protocol interfaces support connectivity from the edge. These interfaces must
be authenticated and encrypted. Standard interfaces from the edge to cloud include
HTTP, MQTT, and AMQP, although custom interfaces can be implemented as
well.
• HTTP: Encrypt all HTTP connections using Transport Layer Security (TLS) 1.2
or later. Use certificates to authenticate TLS connections.
• MQTT: Encrypt and authenticate MQTT communications using TLS 1.2 or later
as well. MQTT communications must ensure that the native username/password
field is encrypted and never sent in cleartext.
• CoAP: Secure UDP-based communications such as CoAP using DTLS.
There are many threats that must be guarded against within the cloud. For
example, most CSPs provide an identity registry that stores the identifies and
configurations of devices connected to the cloud. Amazon Web Services (AWS)
terms these “Thing Shadows.” Proper access controls must be applied to ensure that
unauthorized access to these configuration repositories is not allowed. Similarly,
access to keys must be restricted within the cloud. The use of Hardware Security
Modules (HSMs) in the cloud is often warranted. Unauthorized database access
must also be guarded against.
There are a number of recommendations listed here to lock down an IoT cloud.
Some of these make use of capabilities offered directly by a CSP and others require
the use of third party processes and tools.
10.6.1 Evaluate the Security of the CSP
Each CSP implements its own security architecture and it can be difficult to
objectively evaluate the security state of each provider. To aid in this evaluation,
download and review the Cloud Security Alliance (CSA) Cloud Controls Matrix
(CCM) which provides a set of evaluation criteria to methodically review the
security state of a CSP [29]. This registry contains self-assessments and thirdparty assessment results covering dozens of CSPs. When choosing a CSP to host
IoT system applications, review these assessment results and make comparisons
within the evaluation process to ensure selection of an optimal CSP partner. Once
selected, work with the CSP to establish Service Level Agreements (SLAs) that
detail minimum service levels and include penalties when a CSP does not meet
minimum availability or performance metrics.