508
B. Russell
• Device
• Privileged Device
• System Application
• Privileged Application
• Auditor
• Third Party
10.6.12 Secure Data in the Cloud
Categorize data elements generated by edge machines and transmitted to the cloud
for storage and processing. Implement authenticated access to cloud data storage
and apply encryption to database fields associated with sensitive information.
Configure cloud gateways to accept communications from only trusted devices
and require encrypted communications. Document authorized ports and protocols
on cloud gateways and disable non-authorized ports/protocols. Blacklist any unauthorized device that attempts to communicate and log and report the action. Keep
all cloud infrastructure updated and patched.
10.6.13 Secure Web Services
A 2018 report by Barracuda Networks [30] found that vulnerabilities in mobile
applications and web services allowed attackers to steal the credentials of IoT
devices. IoT machines operate in an interconnected ecosystem, and weaknesses in
any part of that system can result in compromise of individual system components.
Implement encrypted communications between the web application and the
IoT machine. Use token-based authentication for access. Implement secure pairing
methods for short-range RF transactions. Keep mobile devices and applications that
access edge machines updated and configure storage of all key material in hardware.
Develop web services in accordance with OWASP security guidance.
• https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
• https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet V18 of
ASVS 4.0
• https://github.com/OWASP/ASVS/blob/master/4.0/en/0x23-V18-API.md
Also secure the Application Programming Interface (API) keys used by your
applications by not exposing the API keys within public configuration management
tools/repositories.
B. Russell
• Device
• Privileged Device
• System Application
• Privileged Application
• Auditor
• Third Party
10.6.12 Secure Data in the Cloud
Categorize data elements generated by edge machines and transmitted to the cloud
for storage and processing. Implement authenticated access to cloud data storage
and apply encryption to database fields associated with sensitive information.
Configure cloud gateways to accept communications from only trusted devices
and require encrypted communications. Document authorized ports and protocols
on cloud gateways and disable non-authorized ports/protocols. Blacklist any unauthorized device that attempts to communicate and log and report the action. Keep
all cloud infrastructure updated and patched.
10.6.13 Secure Web Services
A 2018 report by Barracuda Networks [30] found that vulnerabilities in mobile
applications and web services allowed attackers to steal the credentials of IoT
devices. IoT machines operate in an interconnected ecosystem, and weaknesses in
any part of that system can result in compromise of individual system components.
Implement encrypted communications between the web application and the
IoT machine. Use token-based authentication for access. Implement secure pairing
methods for short-range RF transactions. Keep mobile devices and applications that
access edge machines updated and configure storage of all key material in hardware.
Develop web services in accordance with OWASP security guidance.
• https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
• https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet V18 of
ASVS 4.0
• https://github.com/OWASP/ASVS/blob/master/4.0/en/0x23-V18-API.md
Also secure the Application Programming Interface (API) keys used by your
applications by not exposing the API keys within public configuration management
tools/repositories.