10 IoT Cyber Security
507
Prefer the use of certificate and token-based approaches instead of passwords
whenever feasible. Do not generate private keys for edge machines in the cloud
unless absolutely necessary. Instead, generate private keys on machine and request
certificates from your Public Key Infrastructure (PKI) Certificate Authority (CA).
Do not share credentials (passwords or certificates) across devices.
Authentication of cloud interfaces consists of both authentication at the gateway
or cloud service (e.g., “the server”) as well as authentication of the edge machine.
Authentication considerations vary somewhat based on the protocol employed. Use
certificates for intra-cloud authentication between cloud servers and gateways.
Establish a global naming convention for IoT machines and services used in
the system. IoT device identities should be unique across an enterprise. Establish
device attribute metadata for each machine to support ease-of-lookup when needed.
Establish group management capabilities to group IoT machines based on their
profiles or usage characteristics.
Some CSPs provide “Identity Registries” which maintain the unique identifiers
of each device and support lifecycle management of devices identities to include
the provisioning, update and deletion of edge IoT device identities. Require
authentication for write access to device identity registries.
10.6.10 Use Zero-Touch Provisioning
Standard such as Device Identifier Composition Engine (DICE) from the Trusted
Computing Group (TCG) specify methods for provisioning cloud trust directly at
manufacture time. Zero-touch provisioning allows implementers acquiring these
cloud-secure MCUs to be provided with a list of Electronic Serial Numbers (ESNs)
and associated public keys to register devices in their specific environment and
securely bootstrap products into an operational environment. Contract with your
MCU vendor enable zero-touch provisioning.
10.6.11 Role-Based Access Controls
Establish roles for applications, gateways, users and machines that interact with or
operate within the cloud. Assign privileged roles to applications and users that are
authorized to manage or configure edge machines. Assign standard roles to single
purpose devices that require limited-scope read/write permissions or to gateways
that provided limited functionality such as simply storing data. Example roles
include:
• Gateway
• Privileged Gateway
• Management Application
507
Prefer the use of certificate and token-based approaches instead of passwords
whenever feasible. Do not generate private keys for edge machines in the cloud
unless absolutely necessary. Instead, generate private keys on machine and request
certificates from your Public Key Infrastructure (PKI) Certificate Authority (CA).
Do not share credentials (passwords or certificates) across devices.
Authentication of cloud interfaces consists of both authentication at the gateway
or cloud service (e.g., “the server”) as well as authentication of the edge machine.
Authentication considerations vary somewhat based on the protocol employed. Use
certificates for intra-cloud authentication between cloud servers and gateways.
Establish a global naming convention for IoT machines and services used in
the system. IoT device identities should be unique across an enterprise. Establish
device attribute metadata for each machine to support ease-of-lookup when needed.
Establish group management capabilities to group IoT machines based on their
profiles or usage characteristics.
Some CSPs provide “Identity Registries” which maintain the unique identifiers
of each device and support lifecycle management of devices identities to include
the provisioning, update and deletion of edge IoT device identities. Require
authentication for write access to device identity registries.
10.6.10 Use Zero-Touch Provisioning
Standard such as Device Identifier Composition Engine (DICE) from the Trusted
Computing Group (TCG) specify methods for provisioning cloud trust directly at
manufacture time. Zero-touch provisioning allows implementers acquiring these
cloud-secure MCUs to be provided with a list of Electronic Serial Numbers (ESNs)
and associated public keys to register devices in their specific environment and
securely bootstrap products into an operational environment. Contract with your
MCU vendor enable zero-touch provisioning.
10.6.11 Role-Based Access Controls
Establish roles for applications, gateways, users and machines that interact with or
operate within the cloud. Assign privileged roles to applications and users that are
authorized to manage or configure edge machines. Assign standard roles to single
purpose devices that require limited-scope read/write permissions or to gateways
that provided limited functionality such as simply storing data. Example roles
include:
• Gateway
• Privileged Gateway
• Management Application