How do you secure an IoT network?

In my experience, this all rings true. That being said, it reflects the absolute need for good communication between the various departments and/or contractors that would need to be involved. Gone are the days of a one man IT department due to the overwhelming amount of IoT devices and their own related risks. So the first step is to build a solid well rounded team with the necessary tools let them work.

Creating and executing a Cyber Security Supply Chain Risk Management (SCRM) Plan is essential to protect organizations from potential cyber threats stemming from their supply chain collaborators. This applies end-to-end and includes everything from solutions, integrations and hardware to software and firmware - and everything in between.

Totally agreed! The risk identification and assessment would definitely be the important for a company to identify your security objective to avoid underestimating or over killing (over investing and slowing down business). Keep in mind that one solution doesn’t always fit all, as different verticals will have different acceptance level of risks.

Unlike servers, PCs or mobile devices, IoT devices are often machines with customised OS, no agent or client installation is allowed, therefore the track of their accesses can be relatively limited but possible with the aid of network, such as using MAC, device connection, connected date and duration, traffic pattern, etc. Yet, keep in mind that this is a dynamic control, or a conditional access, depends on the change of the device posture.

In my experience this is very difficult to achieve without downtime on the IoT devices. In many cases downtime is not an option or severely limited. So having strong controls in place to mitigate the risks of these vulnerabilities is crucial at the network level. Additionally to have a successful patching process this must be collaborative with Operations and Maintenance teams to leverage pre planned downtime for these devices.

In my experience, we need to find the balance between security patch update and service interruption. Sometimes the patch release is once a week and we may have multiple different brands of devices in our network to be updated, and every time the update will cause reboot of the device. We should review the release note of the patch and identify the security risk if we do not apply the patch, e.g. Is it necessary to set downtime and resource to apply the patch if the patch is to fix the vulnerability of a certain features of a device but we actually disabled these features in our devices?

It is crucial to verify the integrity and authenticity of all software and patches provided by the vendor and/or partner when talking both firmware and software.

Again you will be limited with what the IoT devices can support for encrypted protocols. Making investing in the network equipment to achieve this the primary approach that needs to be taken.

Remember too that encryption has two sides; obfuscating your traffic to keep it safe from inspection but also abstracts your network security team’s ability to inspect malicious traffic. Encryption needs to be done in a way that factors this consideration such as a MITM proxy that re-encrypts before traversing any untrusted networks.

From a 3GPP and Satellite perspective, ensuring backhaul from operators is either in a private APN/VPN or a MPLS VPN solution, plus making sure the integrity of a device is not compromised, a SIM card (IMSI/SUPI) should be paired and locked to a specific device (IMEI).

Creating VLANs( virtual local area networks) can be a simple way to segment portions of your network. Many switches and firewalls can facilitate this process with a simple web interface.

Creating VRFs to manage routing tables for different subnets is a useful tool for segmentation. Forcing the traffic into a Data plane versus a management plane and further segmentation between the type of data is very valuable to help define clear scopes. Additionally this simplifies management of sites if configured well to force traffic through firewall interfaces. Furthermore a clear subnet and vlan plan is crucial for IoT as in many cases there are several small networks created to accommodate separate physical locations. Without this Layer 2 sprawl is a real risk and can effect the organizations ability to segment traffic.

Agreed. For home networks, it is critical to change your router/firewall password and user ID that does not identify the type of router or the default ISP name. In addition, you must download a security certificate that utilizes WPA3. Since some devices can’t use WPA3, you need to consider using a certificate with both WPA3 and WPA2 (WPA2 was hacked years ago) or see if you can get new devices that support WPA3). Avoid free certificates and get one from a reputable company. Many IoT devices use UPNP (Universal Plug and Play), this connectivity method requires no password or authentication by default. Segmenting these devices, or using a guest network is critical. Consider any smart device including TVs, streaming, light bulbs, more!

Education is key but also using a nudge theory as a means to change the culture and approach is key. Not overloading people with extraneous and constant training but instead smaller bitesize information on a regular basis.

1. Before purchasing an IoT device, research the manufacturer. Some manufacturers prioritize security more than others. Look for companies that have a good track record of providing secure devices and that regularly release security updates. 2. Change Default Credentials: This is a basic step that is often overlooked. IoT devices often come with default usernames and passwords that are easy for attackers to guess. Change these credentials as soon as you install the device, and use strong, unique passwords. No system is perfectly secure, and maintaining security requires constant vigilance and ongoing effort. Stay informed about the latest security threats and mitigation strategies to keep your network as secure as possible.

Understand which ports your different PLCs use to communicate with your system and work with IT limit the port access. This will ensure only required data and access is allowed.

Approach your IoT with the endgame in mind. In many cases it is very difficult to make changes after the fact. A strong Network Architecture and System Architecture is key to lay the foundations for IoT security. Without this the limitations and constraints will hinder the organizations ability to make changes.

Factory Reset is not enough. When devices reach End of Life, forensically wipe/destroy it. There have been numerous cases were sensitive data was easily found off a device that was simply factory reset rather that wiped. (i.e. WiFi password, network credentials, etc.)

I would add a section about "Always change Default Device Names, User names, and passwords" section between "Apply rule of least privilege" and "Always update and patch your devices and device firmware".