510
B. Russell
the security state of IoT machines, and the rest of the services. Also include
proper procedures and timing of firmware and software updates within the
system and proper procedures for patch management. Proper procedures for
patch management of the system.
• General guidance on maintaining security awareness, to include training on the
identification of malicious software and attempts to trick administrators into
divulging passwords or other sensitive information (e.g., phishing attacks).
• Procedures for investigating and responding to incidents involving the IoT
system. This includes requirements for escalating issues to senior technical and
managerial leadership within the organizations and procedures for interacting
with third-party organizations to perform investigations and remediations – for
example, cloud service providers. This also includes procedures for conducting a
root cause analysis (RCA) as well as requirements for maintaining a secure chain
of custody during an investigation.
• Policies for performing penetration testing and vulnerability scanning of the
system. This includes a description of any tools that should be used in the conduct
of vulnerability analysis.
• Procedures for proper disposal of IoT system equipment. This includes any
procedures associated with sanitization of data stored on IoT products or attached
storage systems.
Proper training of users and administrators is required in order to ensure an
IoT system is operated securely. Without proper training, users and administrators
may fall victim to countless phishing attacks or may improperly dispose of IoT
equipment. By educating users on why the IoT systems they use are targeted by bad
actors and how users can play a role in defending their systems, they can become
powerful allies that can aid in helping to secure large complex IoT systems.
10.7.3 Incident Response Planning
Another aspect of the human element of cyber security is associated with incident
response planning. Planning for the response to incidents involving IoT systems is
similar in nature to traditional I.T. incident response planning. The four phases of an
incident response include (1) planning; (2) detection and analysis; (3) containment,
eradication, and recovery; and (4) post-incident activity. The planning process
involves:
• Identification and assignment of the Incident Response Team
• Establishment of a communication plan
• Development of a training plan that allows the team to execute and respond to
simulated incidents
• Creation of a coordination plan. The coordination plan is essential for IoT
systems as the myriad business-area owners responsible for each IoT system
B. Russell
the security state of IoT machines, and the rest of the services. Also include
proper procedures and timing of firmware and software updates within the
system and proper procedures for patch management. Proper procedures for
patch management of the system.
• General guidance on maintaining security awareness, to include training on the
identification of malicious software and attempts to trick administrators into
divulging passwords or other sensitive information (e.g., phishing attacks).
• Procedures for investigating and responding to incidents involving the IoT
system. This includes requirements for escalating issues to senior technical and
managerial leadership within the organizations and procedures for interacting
with third-party organizations to perform investigations and remediations – for
example, cloud service providers. This also includes procedures for conducting a
root cause analysis (RCA) as well as requirements for maintaining a secure chain
of custody during an investigation.
• Policies for performing penetration testing and vulnerability scanning of the
system. This includes a description of any tools that should be used in the conduct
of vulnerability analysis.
• Procedures for proper disposal of IoT system equipment. This includes any
procedures associated with sanitization of data stored on IoT products or attached
storage systems.
Proper training of users and administrators is required in order to ensure an
IoT system is operated securely. Without proper training, users and administrators
may fall victim to countless phishing attacks or may improperly dispose of IoT
equipment. By educating users on why the IoT systems they use are targeted by bad
actors and how users can play a role in defending their systems, they can become
powerful allies that can aid in helping to secure large complex IoT systems.
10.7.3 Incident Response Planning
Another aspect of the human element of cyber security is associated with incident
response planning. Planning for the response to incidents involving IoT systems is
similar in nature to traditional I.T. incident response planning. The four phases of an
incident response include (1) planning; (2) detection and analysis; (3) containment,
eradication, and recovery; and (4) post-incident activity. The planning process
involves:
• Identification and assignment of the Incident Response Team
• Establishment of a communication plan
• Development of a training plan that allows the team to execute and respond to
simulated incidents
• Creation of a coordination plan. The coordination plan is essential for IoT
systems as the myriad business-area owners responsible for each IoT system