10 IoT Cyber Security
511
or subsystem must be identified. These business area owners will be contacted
immediately during an incident response to begin coordination.
Detection and analysis activities are related to the ongoing monitoring of
system operations for anomalies. This also includes threat intelligence sharing to
ensure that the Security Operations Center (SOC) team is looking for the latest
attempts to exploit devices and services. Additionally, ongoing monitoring includes
monitoring of activities occurring in the cloud and within the Radio Frequency (RF)
environment on-premise.
Containment, eradication, and recovery include the actions related to quarantine
of infected devices or computers. This is necessary to contain the threat and limit
the spread of an infection or an adversaries’ attempts to move laterally through the
system. This also includes the process of eradicating the incident and returning to
normal operations while continuously monitoring for a repeat of the incident.
Post-incident activity includes performing an RCA to determine the exact cause
of the incident as well as how the implemented security defenses failed to achieve
their goals. This also includes information sharing across not only the other security
professionals within the organization but also trusted third-party organizations and
importantly an update to the incident response plan to take into account the realized
incident.
10.8 Conclusion
This chapter described approaches to enhance the cyber security of an IoT system.
The chapter explored the many components which make up an IoT system and the
vulnerabilities associated with the components. We discussed the unique threats
to IoT systems and then provided recommendations for developing secure IoT
products and systems. We then described specific controls that can be applied to
IoT devices at the edge, to the network, and to the cloud as well as to the human
users and administrators of IoT systems. Overall, we gave an in-depth analysis of
vulnerabilities which exist in IoT systems and ways to mitigate such risks to ensure
the integrity of the IoT system.
References
1. https://sebokwiki.org/wiki/Systems_of_Systems_(SoS)#Difference_between_System_of_
Systems_Engineering_and_Systems_Engineering
2. https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-andlessons-learned/
3. https://www.wftv.com/news/9-investigates/-no-one-wants-to-see-that-man-says-someonewas-watching-him-through-his-nest-camera/920933458
4. https://www.wired.com/story/police-body-camera-vulnerabilities/
511
or subsystem must be identified. These business area owners will be contacted
immediately during an incident response to begin coordination.
Detection and analysis activities are related to the ongoing monitoring of
system operations for anomalies. This also includes threat intelligence sharing to
ensure that the Security Operations Center (SOC) team is looking for the latest
attempts to exploit devices and services. Additionally, ongoing monitoring includes
monitoring of activities occurring in the cloud and within the Radio Frequency (RF)
environment on-premise.
Containment, eradication, and recovery include the actions related to quarantine
of infected devices or computers. This is necessary to contain the threat and limit
the spread of an infection or an adversaries’ attempts to move laterally through the
system. This also includes the process of eradicating the incident and returning to
normal operations while continuously monitoring for a repeat of the incident.
Post-incident activity includes performing an RCA to determine the exact cause
of the incident as well as how the implemented security defenses failed to achieve
their goals. This also includes information sharing across not only the other security
professionals within the organization but also trusted third-party organizations and
importantly an update to the incident response plan to take into account the realized
incident.
10.8 Conclusion
This chapter described approaches to enhance the cyber security of an IoT system.
The chapter explored the many components which make up an IoT system and the
vulnerabilities associated with the components. We discussed the unique threats
to IoT systems and then provided recommendations for developing secure IoT
products and systems. We then described specific controls that can be applied to
IoT devices at the edge, to the network, and to the cloud as well as to the human
users and administrators of IoT systems. Overall, we gave an in-depth analysis of
vulnerabilities which exist in IoT systems and ways to mitigate such risks to ensure
the integrity of the IoT system.
References
1. https://sebokwiki.org/wiki/Systems_of_Systems_(SoS)#Difference_between_System_of_
Systems_Engineering_and_Systems_Engineering
2. https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-andlessons-learned/
3. https://www.wftv.com/news/9-investigates/-no-one-wants-to-see-that-man-says-someonewas-watching-him-through-his-nest-camera/920933458
4. https://www.wired.com/story/police-body-camera-vulnerabilities/