How do you keep your IoT devices and software up-to-date?

Draft and implement a proper patch management process to keep all IOT devices and software up to date. Vulnerabilities should be prioritised and fixes applied on time. Deadlines should be proportional to the criticality of the vulnerability and should be clearly defined in the vulnerability management policy.

I would say the first step is to regularly check for updates. Enable automatic updates when available, but if you want more control, visit the device or software's website. This is important for compatibility, stability, security, and the new features. We have to keep things up to date. Just like maintaining a car to ensure it runs smoothly.

Based on my experience below configuration helps. 1. Enable automatic updates when available. 2. Regularly check for manufacturer firmware updates. 3. Change default passwords. Use strong, unique passwords. 4. Isolate IoT devices on a separate network. 5. Remove unsupported or unused devices. 6.Monitor network and develop a good response procedure.

For any organization that has implemented IoT. In terms of best practices. Enable automatic updates when possible, and manually check for updates on a regular basis.

Backing up data and configuration files is unquestionably crucial. Data backups are also a necessity to be compliant to various security and compliance standards (ISO 27001 for example). Backups must be periodically carried out to a secure location (physically and logically isolated from the source). They act as a solid defence against inadvertent data loss/corruption, hardware failure, power outages, natural disasters and unauthorised access due to cyber attacks. In the event of any such catastrophic incident, they have the ability to bestow significant time and financial savings by getting you up and running as usual. Also, make sure you encrypt your backups and protect backups using adequate security controls.

Backing up before updates is crucial to prevent data loss or configuration issues. So store the data securely in the cloud or on external devices and keep track of custom settings for easy restoration if required. This will ensure that the information is safe and restore your preferred setups.

From an IoT perspective, the Edge device's disk is limited. Backing up data needs to be handled carefully, either compressed or backed in the cloud if possible. As for backing up settings: Make sure always to have a proper `digital twin` of your devices. You need to have an undeniable source of truth. This will remove the need to have locally backed settings (which are also taking space)

Reviewing updated details is important because it's like reading the instructions and checking compatibility before assembling a piece of furniture. We need to understand what changes an update brings and ensure that the update is suitable for our devices plus if it’s from a trusted source.

Read The ... Manual isn't just an expression when it comes to software updates. Make sure you understand the complete change log of an update or a patch before you even consider applying it. Verify basic information on version/system compatibility and run relevant tests in a simulated environment before deploying it to production.

Make sure you follow proper procedures to ensure updates are applied correctly, a stable power source is a must with good internet connectivity. Once this is done your device should be functioning properly.

Updates should be installed in a timely manner and properly tested internally on preproduction systems before being deployed to production.

Update functionality is super important. Make sure updates are verified. By identifying crashes or failures the problem can be addressed promptly. If you have any issues always report it to the manufacturer.

Updates should be installed in a timely manner and properly tested internally on preproduction systems before being deployed to production. The tests should ensure that the updates actually fix the underlying issue. Always run your own tests to ensure system updates go seamlessly rather than relying on vendor provided test data. Remember, nobody knows your unique environment more than you do.

Proper asset management will help you understand your own environment much better so you can keep track of what you own, the versions and the updates. There are plenty of open source applications which can do this for you. The goal is to know what you have and to know each individual versions of various systems and components so you know what to update. Maintain an update log so as to keep a record of what was patched so you can identify whats left which will come in handy when you have to troubleshoot problems. Like mentioned above, consider adopting a vulnerability management system which can do all of this for you.

Something that was not yet brought up is asset management. Just as in a corporate environment, your IoT infrastructure should be clearly identified for which IoT devices currently exist in your environment, whether at home or within an organization. Ensuring that you have a current inventory along with network segregation and versioning information will help you to identify rogue devices and suspicious network communications. Another factor to consider before even purchasing IoT devices is the source of them. There can be a big difference in security between devices that come from reputable and trusted sources versus areas of the world that have a history of backdoors or gathering privacy related data.

Always assume IOT devices are insecure by default, especially older devices which were designed with keeping only functionality in mind. Patching/Updating is good but it does not guarantee security. Make sure you monitor them by forwarding logs to tools like security information and event management (SIEM) systems, intrusion detection/prevention systems, so you can keep an eye on them. Some IOT devices depend on sending data to the cloud to work but what is preventing them from sending more than what is needed? Leverage threat intelligence to automate and enhance your monitoring capabilities to detect malicious activity. Conduct regular red teaming / penetration testing engagements to identify and address weaknesses.

Always remember that the "S" in IoT stands for security. One of the main questions you need to ask from a security perspective regarding any IoT implementation is: Is it needed? What is the value add? Is this the best solution to your problem? Don't add complexity and increase your attack surface unless there is a legitimate business need. We, as an industry, need to demand security from our vendors if we want them to take security seriously. The same applies to any IoT vendor.

Managing industrial IoT demands well-organized processes and empowered structures. As IoT has grown, it's merged cyber and physical security realms. An up-to-date inventory of IoT products is crucial. Every device must be monitored. Selecting IoT devices should not be about cost-saving. Early IoT devices often overlooked cyber security. Thus, choosing mature, security-focused products is essential for a safe IoT environment.