12 Tips for Implementing IoT Security
12 Tips for Implementing IoT Security
A failure to secure IoT devices could stall the progress of the Internet of things, preventing the technology from fully realizing its vast potential.
Broad Security Needed
IoT security needs to span from cloud to end device: any vulnerability affecting many end devices could have a wide impact on the rest of the system or service.
Implement Security at Design Time
Security should be implemented in IoT products at design time. It should derive from a system view and be built from a mix of hardware and software features.
Three Types of IoT Security
Security for IoT nodes can mean many different things. We can categorize them into three different groups: Lifecycle security, Communication security, Device security.
Lifecycle Security
Lifecycle security covers the ability to securely and remotely manage the device at different stages of its life, from configuration, monitoring and upgrade, until its decommissioning or revocation.
Communication Security
Communication security relates to the measures that should be put in place to guarantee the integrity, authenticity and confidentiality of the link between the device and the cloud.
Device Security
Device security focuses on the integrity of the IoT node itself, the protection of its resources, data, and behavior over the time of its deployment in the field.
Security Proportional to Threats
The security implementation needs to be proportional to the threats the device will face, and also to the estimated cost of a security breach.
Comprehensive Threat Assessment
A threat assessment needs to be completed and should take the whole system into consideration, including potential side effects.
Make Protection against Scalable Attacks the Priority
For IoT nodes, protection against scalable attacks—those that can inexpensively be duplicated in other devices—is a priority.
Chain of Trust
Security can be built into a system as a chain of trust, starting with a Root of Trust—a minimal secure domain with dependable security functions, with private access to protected keys. To implement this properly, isolation is key.
Rely on Pre-Integrated Solutions
Designing a secure product from scratch is time-consuming and prone to security holes. It saves time to rely on pre-integrated solutions that expert teams have verified.
Include Security Evaluation Into Product Development
A security evaluation, for example, an external security code audit or white box testing, should be planned into the product development.
