Eight Steps to Securing IP in the IoT Era
By Karen A. Frenkel
For most companies, hardware designs or source code are their most valuable assets. Ensure that you understand what is most valuable to your organization and where it resides.
Don’t grant broad access rights to these key assets. Research shows that most internal staff can pose a significant security threat. Corporate processes must be in place to continuously monitor who accesses what IP.
Ensure that data is transmitted securely (i.e., encrypted) between designer or developer desktops and your SCM repository. Encrypt the files once stored in the repository.
Multiple layers of authentication make it more difficult for attackers to compromise user credentials. Selectively grant access permissions for specific users and assets down to the file level.
Enforce strong passwords and different levels of security controls based on asset type. Provide password hardening options and strong password policies, time-limited authentication tickets and ensure secure storage of passwords.
Continuously monitor data access and make sure that detailed audit logs are implemented in a secure SCM repository. Besides tracking access that indicates risk, certain industries’ standards and compliance regulations require detailed audit logs of access to data, as well as development records.
Install a security platform that applies behavioral analytics models to audit logs and quickly identify high-risk, anomalous data access. Threshold- or trigger-based alerts are weak and expensive to maintain. Tools should be automated and self-learning.
Integrate SIEM (security information and event management) and other log data with a flexible security platform that can identify high-risk threats throughout your organization. If existing SIEM tools monitor access and activity, ensure that your SCM monitoring tools are integrated with your SIEM dashboards.