506
B. Russell
10.6.5 Manage Cloud Identities
Management of IoT devices across a global organization will quickly become
challenging if a standard naming approach is not agreed upon and implemented.
Guard against future scalability issues by implementing a central directory. Use
globally unique names for all devices.
10.6.6 Require Multi-Factor Cloud Authentication
A cyber security best practice today is to use multi-factor authentication for all
access. Although this is often difficult to achieve at the device level, this requirement
should always be implemented for access to the cloud services that support edge
devices. Various MFA approaches can be implemented to include requiring SMSbased texts or email validation of codes prior to logging in. Look to protocols such as
those from Fast Identity Online (FIDO) (e.g., FIDO 2) to implement cost-effective
MFA methods.
10.6.7 Audit Cloud Services
Many CSPs will allow your team to conduct limited-scope penetration testing of the
services running in the cloud. Ensure that this is allowable and if so schedule regular
penetration tests against the cloud installation. Also monitor for adherence to all
SLA metrics and promptly notify a CSP if any metric fails to meet requirements.
10.6.8 Monitor the Cloud
Make use of native CSP monitoring services and integrate into a wider enterprise
monitoring strategy. Make use of third-party managed security service providers
(MSSP) when necessary and feasible to monitor 24/7 for suspected malicious
activity. CSP monitoring services can often provide near real-time inputs on actions
occurring on the API and within the cloud itself.
10.6.9 Implement Cloud Identity Management
Establish an identity and access management (IAM) process for all credentials
used to authenticate to the cloud, including those provisioned to edge machines.
B. Russell
10.6.5 Manage Cloud Identities
Management of IoT devices across a global organization will quickly become
challenging if a standard naming approach is not agreed upon and implemented.
Guard against future scalability issues by implementing a central directory. Use
globally unique names for all devices.
10.6.6 Require Multi-Factor Cloud Authentication
A cyber security best practice today is to use multi-factor authentication for all
access. Although this is often difficult to achieve at the device level, this requirement
should always be implemented for access to the cloud services that support edge
devices. Various MFA approaches can be implemented to include requiring SMSbased texts or email validation of codes prior to logging in. Look to protocols such as
those from Fast Identity Online (FIDO) (e.g., FIDO 2) to implement cost-effective
MFA methods.
10.6.7 Audit Cloud Services
Many CSPs will allow your team to conduct limited-scope penetration testing of the
services running in the cloud. Ensure that this is allowable and if so schedule regular
penetration tests against the cloud installation. Also monitor for adherence to all
SLA metrics and promptly notify a CSP if any metric fails to meet requirements.
10.6.8 Monitor the Cloud
Make use of native CSP monitoring services and integrate into a wider enterprise
monitoring strategy. Make use of third-party managed security service providers
(MSSP) when necessary and feasible to monitor 24/7 for suspected malicious
activity. CSP monitoring services can often provide near real-time inputs on actions
occurring on the API and within the cloud itself.
10.6.9 Implement Cloud Identity Management
Establish an identity and access management (IAM) process for all credentials
used to authenticate to the cloud, including those provisioned to edge machines.