10 IoT Cyber Security
509
10.7 Secure System Users and Administrators
Any system is only as secure as the weakest link in that system. The weakest link is
usually the user of the system that is untrained in the basics of cyber security. Users
can be turned from a weakness to an advantage by educating them on the threats
faced by the systems they use and the ways they can help to keep systems and data
secure.
10.7.1 User Training
Establish training for system users. Training for users should include the following
topics at minimum:
• The risks associated with use of their IoT systems. This includes a discussion
of the threat actors that target their systems and the motivations for attempting
to gain access to systems. Users should have a clear understanding why their
systems are at risk of being compromised and the impact that a system/data
breach would have on their organization and the customers of the organization.
• The types of IoT devices that are authorized to be used within the system. This
includes any restrictions on devices that may be brought from home and added
to the system, or any policies that limit use of certain types of devices within the
system.
• The presence of any safety-related risks associated with the IoT system. This
is especially important in human/robot collaborative systems where interaction
with automated machinery may occur.
• General guidance on avoiding phishing attempts and other attempts to trick users
into divulging sensitive account information.
10.7.2 Administrator Training
System administrators should also be trained on the proper function and security
of their IoT systems. System administrator training should be extensive and should
include:
• A detailed technological overview of the IoT system that includes a discussion
of all sensitive data collected by the system, key architectural components of the
systems, high value components of the system.
• Policies for allowable use of the IoT system. This includes a detailed description
of the policies for integrating new device types into the network. For example,
any requirement that a product be certified as secure by a third party. This can
include procedures for bringing new devices online, procedures for monitoring
509
10.7 Secure System Users and Administrators
Any system is only as secure as the weakest link in that system. The weakest link is
usually the user of the system that is untrained in the basics of cyber security. Users
can be turned from a weakness to an advantage by educating them on the threats
faced by the systems they use and the ways they can help to keep systems and data
secure.
10.7.1 User Training
Establish training for system users. Training for users should include the following
topics at minimum:
• The risks associated with use of their IoT systems. This includes a discussion
of the threat actors that target their systems and the motivations for attempting
to gain access to systems. Users should have a clear understanding why their
systems are at risk of being compromised and the impact that a system/data
breach would have on their organization and the customers of the organization.
• The types of IoT devices that are authorized to be used within the system. This
includes any restrictions on devices that may be brought from home and added
to the system, or any policies that limit use of certain types of devices within the
system.
• The presence of any safety-related risks associated with the IoT system. This
is especially important in human/robot collaborative systems where interaction
with automated machinery may occur.
• General guidance on avoiding phishing attempts and other attempts to trick users
into divulging sensitive account information.
10.7.2 Administrator Training
System administrators should also be trained on the proper function and security
of their IoT systems. System administrator training should be extensive and should
include:
• A detailed technological overview of the IoT system that includes a discussion
of all sensitive data collected by the system, key architectural components of the
systems, high value components of the system.
• Policies for allowable use of the IoT system. This includes a detailed description
of the policies for integrating new device types into the network. For example,
any requirement that a product be certified as secure by a third party. This can
include procedures for bringing new devices online, procedures for monitoring