Eight Steps to Securing IP in the IoT Era
Eight Steps to Securing IP in the IoT Era
By Karen A. Frenkel
Identify Your Most important IP
For most companies, hardware designs or source code are their most valuable assets. Ensure that you understand what is most valuable to your organization and where it resides.
Choose Who Should Have Access to This IP
Don’t grant broad access rights to these key assets. Research shows that most internal staff can pose a significant security threat. Corporate processes must be in place to continuously monitor who accesses what IP.
Encrypt Data at Rest and in Transit
Ensure that data is transmitted securely (i.e., encrypted) between designer or developer desktops and your SCM repository. Encrypt the files once stored in the repository.
Use Multifactor, Continuous Authentication and Fine-Grained Access Control
Multiple layers of authentication make it more difficult for attackers to compromise user credentials. Selectively grant access permissions for specific users and assets down to the file level.
Enforce Strong Passwords and Different Levels of Security Controls
Enforce strong passwords and different levels of security controls based on asset type. Provide password hardening options and strong password policies, time-limited authentication tickets and ensure secure storage of passwords.
Continuously Monitor Data Access
Continuously monitor data access and make sure that detailed audit logs are implemented in a secure SCM repository. Besides tracking access that indicates risk, certain industries’ standards and compliance regulations require detailed audit logs of access to data, as well as development records.
Implement a Security Platform
Install a security platform that applies behavioral analytics models to audit logs and quickly identify high-risk, anomalous data access. Threshold- or trigger-based alerts are weak and expensive to maintain. Tools should be automated and self-learning.
Integrate SIEM and Other Log Data
Integrate SIEM (security information and event management) and other log data with a flexible security platform that can identify high-risk threats throughout your organization. If existing SIEM tools monitor access and activity, ensure that your SCM monitoring tools are integrated with your SIEM dashboards.
