Packt+ | Advance your knowledge in tech

You're reading from Practical Internet of Things Security - Second Edition

Product typeBook

Published inNov 2018

Publisher

ISBN-139781788625821

Edition2nd Edition

Tools

AWS Azure

Concepts

Internet of Things Security

Authors (2):

Brian Russell

Drew Van Duren

View More author details

Chapter 5. Operational Security Life Cycle

So, you now have a hundred or a thousand, or a hundred thousand, IoT devices deployed by numerous business units across your organization. How are you going to lock down those devices? How are you going to manage device credentials and keys in the long term? How are you going to train your stakeholders to administer or use these devices securely? How are you going to be alerted to a potential intrusion in your system? And what are you going to do when you've identified an intrusion or a breach of data? To answer all of these questions, you need an operational security life cycle:

This chapter introduces an IoT system security life cycle that can be tailored to the unique operating needs of a system. We focus on four phases across the life cycle:

Define:
- Define system security policies
- Define system roles
Implement/integrate:
- Configure gateways and network security
- Bootstrap and securely configure devices
- Set up threat intelligence and vulnerability monitoring...

Defining your security policies

Define your IoT system technical security policies. Use automated tools to check for compliance with these policies whenever possible. Security policies for your system will vary based on unique system characteristics, but some recommended policies include:

Secure communications:
- All communications are authenticated and encrypted
- TCP communications are encrypted using TLS 1.2 or higher
- TLS communications are authenticated using client/server certificates
- Unneeded ports/services are disabled
- Outbound communications that did not originate from a device are rejected (DENY)
Cryptography:
- Only approved cryptographic ciphers are used within the system
- Only approved key lengths are used within the system
- Devices are configured to avoid negotiating unapproved cryptographic algorithms and protocols (negotiating downwards)
Key and certificate management:
- Certificate lifetimes are limited to no more than three years' duration
- All key material is stored in a trusted enclave/element...

Defining system roles

IoT systems can oftentimes require complex access control frameworks. Consider the types of devices and types of users who will operate within your system and define a set of roles that will be granted access to various aspects of IoT system administration and operation. In the following example, roles are defined and include multiple roles for devices (such as, privileged versus regular gateway) and users:

Configuring gateway and network security

IoT systems consist of multiple gateways, networking protocols, and even physical mediums. Edge devices may connect to each other within a Wireless Sensor Network (WSN) using short-range protocols such as ZigBee and Z-Wave, while gateways connect to the cloud over IP connections using messaging frameworks, such as MQTT or REST. Securing an IoT system requires a comprehensive evaluation and lockdown of the gateways and networking components of the system.

Securing WSN

WSNs can consist of thousands or more low-power battery-operated sensors that communicate using protocols, such as ZigBee, Z-Wave, Bluetooth, NFC, or Thread. WSNs make use of gateways that can act as translation devices between the short-range RF protocols and IP-based protocols that communicate with the cloud. Security administrators must consider the secure configuration of the devices and protocols used within WSNs, as well as how to manage securely keys used within WSNs.

Establishing...

Bootstrapping and securely configuring devices

Secure bootstrapping concerns the processes associated with the initial provisioning of passwords, credentials, network information, and other parameters to the devices and the enterprise systems that need to be aware of the devices. When new devices are incorporated into a network, it is vital that they be distinguished as being legitimate rather than rogue or hostile devices. Secure bootstrapping consists of the security processes necessary to ensure that a new (or reintroduced) device undergoes the following:

Registers, either directly or indirectly, its identity to the network and/or the backend systems to which it connects
Receives knowledge of the network and backend system and server identities—this will frequently be in the form of installing default cryptographic credentials (trust anchors and trust paths)
Receives a secure configuration that has been well vetted according to a security policy
Receives knowledge of its network, subnet,...

Setting up threat intelligence and vulnerability tracking

Information is power. Take the time to set up your threat intelligence and vulnerability tracking capabilities to ensure that you can see what is going on in your networks as well as what is happening on a larger scale in the security industry.

Vulnerability tracking

Assign someone to track newly discovered vulnerabilities in the software, firmware, and hardware installed within your networks. Track CVE entries within the National Institute of Science and Technology (NIST) National Vulnerability Database at https://nvd.nist.gov/.

Threat intelligence

There are threat intelligence offerings on the market that you may consider. Threat intelligence offerings can provide you with information on threat actors that are targeting your specific industry, along with their motivations. CrowdStrike is a good example of a threat intelligence organization that makes use of multiple intelligence gathering techniques to identify the latest threat actors...

Managing assets

There is more to discuss related to IoT asset management than simply keeping track of the physical location of each component. Some IoT devices can benefit from predictive analytics to help identify when an asset requires maintenance and also detect in real time when an asset has gone offline. By incorporating new data analytic techniques into an IoT ecosystem, organizations can benefit from these new capabilities and apply them to the IoT assets themselves.

When imaging a device such as an autonomous connected vehicle working on a construction site, or perhaps a robot on a manufacturing floor, the ability to predict failure becomes significant. Prediction is only the first step, however, as the IoT matures with new capabilities to automatically respond to failures and even autonomously swap out broken components for new replacements.

Consider a set of drones used in security and surveillance applications. Each drone is essentially an IoT endpoint that must be managed by the...

Managing keys and certificates

Keys and certificates provide identities to IoT devices, gateways, and other components and enable secure data in transit across IoT systems. Although most organizations have existing agreements with PKI providers for Secure Sockets Layer (SSL) certificates, the provisioning of certificates to IoT devices frequently do not fit the typical SSL model. PKI service providers such as GlobalSign and Digicert have begun tailoring their certificate offerings towards the IoT. Another option however is the stand-up of an in-house PKI.

Device certificates chain up to root certificates, also known as trust anchors. These trust anchors are provisioned to devices and enable trust within an organization. There must be processes in place to manage these trust anchors. For example, deleting trust anchors that may have been compromised or adding new trust anchors to extend trust.

Certificates must also be actively managed. Certificate lifetimes should be limited (for example,...

Managing accounts, passwords, and authorizations

Just as with keys and certificates, accounts and passwords should be actively managed. Passwords used for remote access to IoT devices, or used to restrict operational IoT activities (for example, pub/sub message handling) should be rotated regularly. This is not possible using manual methods, so automation is key here. Tools, such as those from ForgeRock, provide options to enable automated account and password management.

ForgeRock allows you to pair their identity management platform with identity edge controllers that are installed on IoT devices. This pairing supports password policy enforcement, including password strength, age, and reuse, and supports dynamic authorization decisions for device-to-device, device-to-service, and user-to-device relationships.

Managing firmware and patching updates

Patching and updates concern how software and firmware binaries are provisioned to IoT devices. Most legacy and even some new systems require direct connections (for example, USB, console, JTAG, Ethernet, or others) to locally and manually update a device to new versions. Given the migration to cloud-based monitoring and management, many newer devices have the capability to update or patch software over the network from the manufacturer or dedicated device/system manager. Severe vulnerabilities are possible in software update and patching workflows; therefore, in the device engineering process, it is crucial that the following be supported in any over-the-air patching capability:

End-to-end software/firmware integrity and authentication from the build system through any staged transit to the device (in many cases, confidentiality may also be needed)
The software/update process should only be performed via a special access function that is only available...

Monitoring your system

There are many challenges to monitoring your IoT system. For example, some devices may not generate security audit logs, and many devices do not support formats such as syslog. Gaining timely access to device log data can prove difficult, and the confidence in the integrity of IoT device audit logs may be limited, given minimal, if any, protection mechanisms applied to the logs. Even so, there are events that should be monitored within an IoT system. Any of these events on their own are not necessarily an indicator of compromise; however, security analysts should correlate events across the system to determine if further investigation is required. Some events to monitor within an IoT system include:

Device not reachable
Time-based anomalies
Spikes in velocity, especially at odd times of the day
Drops in velocity
New protocols emanating or targeting an IoT device
Variances in data collected past a threshold
Authentication anomalies
Attempted elevations of privilege
Rapid change...

Training system stakeholders

In 2015, OpenDNS released a report on the IoT in the enterprise. This report provided an early glimpse into challenges that security practitioners will soon face. The report identified that employees had been connecting their own IoT devices into their employer networks, and found that devices such as smart televisions were reaching out through enterprise firewalls to manufacturer IP addresses across a number of ports. This research demonstrated the need to train employees on what is appropriate to connect to the network and to train security administrators to be on the lookout for inappropriately connected consumer IoT devices.

There are not a lot of ready-made training options available for your stakeholders. Even so, it is possible to create your own in-house training material and provide them with it on a regular basis. This section describes content that should be included in security awareness training for employees and in training for security and system...

Performing penetration testing

Assessing the organization's IoT implementations requires testing of hardware and software, and should include regularly scheduled penetration test activities as well as autonomous tests that occur throughout the cycle of the operation.

Aside from being a good security practice, many regulations require third-party penetration tests that in the future will include IoT devices/systems. Penetration tests can also validate the existing security controls and identify gaps within the implemented security controls.

Blue teams should also be used to continuously evaluate the security posture of the enterprise as red teams are conducting their exercises. Also, it is vital to assess the security posture of new IoT infrastructure software and hardware components prior to introducing them into the architecture.

Red and blue teams

Conducting a penetration test of an IoT system is not significantly different from penetration testing more traditional IT systems, although there...

Managing compliance

Continuous monitoring for IoT security compliance is a challenge and will continue to be a challenge as regulators attempt to catch up with mapping and extending existing guidance to the IoT.

Compliance represents the security and policy requirements that are inherited and applicable to one's IoT deployment. From a security life-cycle perspective, compliance is wholly dependent on the specific industry regulatory environment and whether it is commercial or government. For example, devices and systems playing a role in credit and debit card financial transactions must adhere to the Payment Card Industry (PCI) series of standards for point-of-sale devices as well as core infrastructure. Military systems typically require DITSCAP and DIACAP types of Certification and Accreditation (C&A). Postal devices that perform financial transactions in the form of package and envelope postal metering must adhere to the postal authority's standards for such devices. Postal meters...

Managing incidents

Just as the IoT blends together the physical and electronic world, it also blends together traditional IT capabilities with business processes—business processes that have the ability to impact the bottom line of an organization when interrupted. Impacts can include financial loss, reputation damage, and even personnel safety and loss of life. Managing IoT-related incidents requires security staff to have better insights into how the compromise or disruption of a particular IoT system impacts the business. Responders should be familiar with business continuity plans (which need to be developed with the IoT system in mind) to determine which steps to take to respond to an incident.

Microgrids provide a valuable example for incident management. Microgrids are self-contained energy generation, distribution, and management systems that may or may not be connected to a larger power distribution infrastructure. Identifying an incident involving one of the Programmable Logic Controllers...

Performing end-of-life maintenance

The disposal phase of a system can apply to the system as a whole or to individual components of the system. IoT systems can generate significant data; however, minimal data is typically kept on the devices themselves. This does not, however, mean that the controls associated with IoT devices can be overlooked. Proper disposal procedures can prevent adversaries gaining physical access to IoT devices (for example, dumpster diving for old electronics).

Secure device disposal and zeroization

Many IoT devices are configured with cryptographic material that allows them to join local networks or authenticate and communicate securely with other remote devices and systems. This cryptographic material should be deleted and wiped from the devices prior to their disposal. Ensure that policies and procedures address how authorized security staff should perform secure removal of keys, certificates, and other sensitive device data when devices need to be disposed of. Accounts...

Summary

In this chapter, we discussed the IoT security life-cycle management processes associated with IoT device implementation, integration, operation, and disposal. Each has vital subprocesses that must be created or adopted for use in any IoT deployment and in just about any industry. While much attention is given in the literature to secure device design (or lack thereof), firm attention must also be given to secure integration and operational deployment.

In Chapter 6, Cryptographic Fundamentals for IoT Security Engineering, we will provide a background in applied cryptography as it relates to the IoT. We provide this background because many legacy industries new to security may struggle to correctly adopt and integrate cryptography into their products.

The rest of the chapter is locked

You have been reading a chapter from

Practical Internet of Things Security - Second Edition

Published in: Nov 2018Publisher: ISBN-13: 9781788625821

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

undefined

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at $15.99/month. Cancel anytime

Authors (2)

Brian Russell

Brian Russell is the founder of TrustThink, LLC, where he leads multiple efforts towards the development of trusted IoT solutions. He has over 20 years of information security experience and has led complex system security engineering programs in the areas of cryptographic modernization, cryptographic key management, unmanned aerial systems, and connected vehicle security. He is the co-chair of the Cloud Security Alliance (CSA) IoT Working Group and was the recipient of the 2015 and 2016 CSA Ron Knode Service Award. Brian is an adjunct professor at the University of San Diego (USD) in the Cyber Security Operations and Leadership program.
Read more about Brian Russell

Drew Van Duren

Drew Van Duren has provided 20 years of support to commercial and government customers in their efforts to secure safety-of-life and national security systems. He has provided extensive applied cryptographic design, key management expertise, and system security architecture design through rigorous integration of system security design with the core engineering disciplines. Drew has managed as Technical Director the two largest FIPS 140-2 test laboratories, security-consulted for the New York City Connected Vehicle Pilot Deployment, and participated in multiple standards groups such as the RTCA, SAE, and IEEE 1609 working group. Today, he supports the IEEE P1920 committee heading security architecture for unmanned aircraft aerial networks.
Read more about Drew Van Duren

Other recommended products

Related to this chapter

Hands-On Cryptography with Python

Cryptography is essential to protect sensitive information, but it is often performed inadequately or incorrectly. This book will show how to encrypt, evaluate, compare, and attack your data using Python. Overall, the book will help you deal with the common errors in encryption and would know how to exploit them.

BookJun 2018100 pages

Practical Industrial Internet of Things Security

This book provides you with a comprehensive understanding of Industrial IoT security; and practical methodologies to implement safe, resilient cyber-physical systems. It will help you develop a strong foundation and deeper insights on the entire gamut of securing connected industries, from the edge to the cloud.

BookJul 2018324 pages

Azure IoT Development Cookbook

It is important to develop robust and reliable solutions for your organization to leverage IoT services. Microsoft’s end-to-end IoT platform is the most complete IoT offering. It empowers enterprises to build and realize value from their IoT solutions for innovative business outcomes with Microsoft Azure IoT. This book will teach you how to connect multiple devices to the Azure IoT hub, develop, manage the IoT hub service, and integrate the hub with the cloud.

BookAug 2017254 pages

IoT Penetration Testing Cookbook

IoT is an upcoming trend in the IT industry today; there are a lot of IoT devices on the market but there is a minimal understanding of how to safeguard them. If you are a security enthusiast or pentester, this book will help you understand how to exploit and secure IoT devices. You will learn how to identify vulnerabilities in IoT device architecture and firmware using software and hardware pentesting techniques, and you'll also focus on various IoT exploitation techniques and security automation.

BookNov 2017452 pages

Hands-On Security in DevOps

Hands-On Security in DevOps explores how the techniques of DevOps and Security should be applied together to make cloud services safer. By the end of this book, readers will be ready to build security controls at all layers, monitor and respond to attacks on cloud services, and add security organization-wide through risk management and training.

BookJul 2018356 pages

Enterprise Internet of Things Handbook

Internet of Things is today and now. This “hand” book covers almost all the bare essential knowledge that is needed for an architect or a developer to build IoT solution. Right from understanding what IoT is and exploring various off of the shelf IoT platforms, this book has it all. This book also covers Machine Learning IoT at a basic level using Azure Machine Learning Studio.

BookApr 2018332 pages

Developing IoT Projects with ESP32

ESP32 is a low-cost, low-power MCU series by Espressif systems that can be used in wireless IoT applications. With Wi-Fi and Bluetooth technologies as well as security features, it's a full-fledged SoC for developing IoT products for consumer and industrial markets. This book will help you get up to speed with ESP32 using interesting projects.

BookSep 2021474 pages

Building Bluetooth Low Energy Systems

Technology is expanding and so are our networks. The coming era is the age of the Internet of Things and it requires a seamless integration of software with hardware. The need for power-efficient connectivity is greater than ever. Bluetooth Low Energy presents a low-cost, small-distance communication platform that completely solves this problem. This book will introduce you to the technical aspects and implementation of BLE, which will enable you to create customized Bluetooth Low Energy Systems for day-to-day use.

BookApr 2017242 pages

Information Security Handbook

Having an information security mechanism is one of the most crucial factors for any organization. Important assets of organization demand a proper risk management and threat model for security, and so information security concepts are gaining a lot of traction. This book covers the concept of information security, and shows you why it’s important.

BookDec 2017330 pages

Modern Cryptography for Cybersecurity Professionals

Every minute of the day, there are petabytes of data exchanged between our homes, cars, businesses, and IoT devices. But just what exactly is involved when using cryptographic techniques? Modern Cryptography for Cybersecurity Professionals will help you to understand common cryptographic techniques and terms used today to secure our data.

BookJun 2021286 pages

Internet of Things for Architects

The Internet of Things (IoT) is the most significant factor in the technology industry in the last 10 years. It will usher in the third industrial revolution and significantly impact global economies. Industry giants are in the process of adopting IoT solutions to add value, reduce costs, and improve people’s lives. As such, the architectural side of IoT has become critical. This book will help you understand the plethora of technologies that can be used to build a successful IoT deployment. This professional guide will help you architect IoT solutions for a variety of industries and organizations.

BookJan 2018524 pages

IoT and Edge Computing for Architects

New edition of the top-selling guide to IoT and edge computing for architects that helps you create IoT solutions for a variety of industries and organizations.

BookMar 2020632 pages

Personalised recommendations for you

Based on your interests and search pattern

Architectural Patterns and Techniques for Developing IoT Solutions

This book covers all the patterns and considerations that give you both the power and flexibility to build scalable, secure, and performant IoT solutions by combining various patterns in interesting ways. It also lists the benefits of combining IoT with technologies like blockchain, 3D-printing, 5G, Generative AI, quantum computing, and LLMs.

BookSep 2023304 pages

Arduino Data Communications

Arduino Data Communication focuses on IoT’s Internet aspect, guiding you in setting up your own infrastructure for storing and managing the data collected from sensors. This book goes beyond microcontroller basics, equipping you with the knowledge essential for building real-world projects.

BookNov 2023286 pages5

Arduino IoT Cloud for Developers

From fundamental principles to advanced techniques, this comprehensive book equips you with the knowledge and skills needed to design and deploy IoT applications seamlessly. Explore cloud integration, best practices, and real-world projects to harness the full potential of IoT application development with the Arduino IoT Cloud.

BookNov 2023402 pages

The Azure IoT Handbook

Building IoT Systems with Azure IoT is a comprehensive introduction for those who are new to the Internet of Things and looking to get up to speed in no time. This book will teach you how to create and develop IoT solutions with intelligent edge-to-cloud technologies in the Azure cloud.

BookDec 2023248 pages

Role	Definition
Gateway	Allows communications with IoT devices and other authorized services.
Privileged Gateway	Allows standard gateway functions in addition to being able to manage devices (create/delete/update).
Device	Devices that can perform routine operations. They can participate in /publish/subscribe protocol interactions.
Privileged Device	Devices that require elevated privileges (for example, a first-responder vehicle moving through an intersection).
Management Application	Allows for management of IoT devices including firmware updates and configuration management...