Chapter 9. Setting Up an IoT Compliance Monitoring Program

The security industry consists of an extremely broad set of communities, overarching goals, capabilities, and day-to-day activities. The purpose of each, in one form or another, is to better secure systems and applications and reduce risks within the ever-changing threat landscape.

Compliance represents a necessary aspect to security risk management, but is frequently regarded as a dirty word in security. There is a good reason for this. The term compliance invokes feelings of near-zombie-like adherence to sets of bureaucratically-derived requirements, which are tailored to mitigate a broad set of static threats. That's a mouthful of justifiable negativity.

We'll let you in on a second, dirty, not-so-much-of-a secret in our community: compliance, by itself, fails to actually secure systems; unless, that is, the regimen includes a lot of practical, dynamic processes that result in continuous improvement.

That said, security is only one...

IoT compliance

Let's first examine what we mean when we use the term IoT compliance. What we mean by this is that the people, processes, and technologies that make up an integrated and deployed IoT system are compliant with some set of regulations or best practices.

There are many compliance schemes, each with a plethora of requirements. If we were to explore what compliance means for a traditional information technology system, for example, we would see requirements such as the financial Payment Card Industry (PCI) Data Security Standard (DSS), an example being PCI DSS 1.4:

"Install personal firewall software on any mobile and/or employee-owned devices that connect to the internet when outside the network (for example, laptops used by employees), and which are also used to access the network."

Even though this requirement is geared toward mobile devices, it is clear that many IoT devices do not have the ability to implement firewall software. How then does an IoT system show compliance, when...

A complex compliance environment

As a security professional, you are responsible for being compliant with security standards that have been published for the industries within which you operate. Many organizations are faced with meeting regulatory standards that span multiple industries. For example, a pharmacy may be responsible for being compliant with HIPAA as well as PCI regulations, because it must protect both patient data and financial transactions.

These concepts still apply to the IoT; some of the things are new, but the information types and protection mandates have been around for some time.

Challenges associated with IoT compliance

IT shops have traditionally had to track compliance with cybersecurity and data privacy regulations and standards. The IoT introduces new aspects of compliance. As embedded compute and communications capabilities are introduced into organization's physical assets, the need to focus on compliance with safety regulations must also come into play.

The IoT...

Summary

The IoT is still in its infancy, and while compliance is certainly a dicey subject, the most important, overarching goal in setting up a compliance program is to ensure that it is effective and cost-effective overall.

In this chapter, you were introduced to a variety of compliance programs unique to certain industries. In addition, you were provided with some important best practices for setting up your own program. While there are still many gaps with regard to IoT standards and frameworks, there are significant developments among standards bodies today that are beginning to close these gaps.

In Chapter 10, Cloud Security for the IoT, we will discuss the cloud, the fog and threats to cloud-enabled IoT systems. We will also explore CSP IoT security offerings.