Key AWS services
The essential AWS security services in IoT are the
AWS IoT Core,
AWS IoT Device Management,
AWS IoT Device Defender,
AWS Identity and Access Management (IAM), and
Amazon Cognito. In combination, these services along with other
AWS security services allow you to securely control access to IoT
devices, AWS services, IoT applications and resources for your
users. Additional AWS services such as
AWS IoT Greengrass,
Amazon S3,
Amazon DynamoDB, and
Amazon Relational Database Service are often used in IoT applications.
The following services and features support IoT security:
Design: The AWS Device
Qualification Program provides IoT endpoint and edge hardware that
has been pre-tested for interoperability with AWS IoT. Tests
include mutual authentication and OTA support for remote patching.
Asset inventory:
AWS IoT Device Management can be used as an inventory for IoT
devices and AWS Systems Manager Inventory can be used to provide
visibility into on premises computing resources and edge gateways.
AWS Identity and Access Management
(IAM): Device credentials (X.509 certificates, IAM,
Amazon Cognito identity pools and Amazon Cognito user pools, or
custom authorization tokens) enable you to securely control device
and external user access to AWS resources. AWS IoT policies add
the ability to implement fine grained access to IoT devices.
AWS Private Certificate Authority provides a cloud-based approach to
creating and managing device certificates. Use AWS IoT thing
groups to manage IoT permissions at the group level instead of
individually. Use the AWS IoT credentials endpoint to obtain
temporary IAM credentials in an IoT device in order to use AWS
services from the IoT device.
Detective controls:
AWS IoT Device Defender records device communication and cloud
side metrics from
AWS IoT Core.
AWS IoT Device Defender can automate security responses by
sending notifications through
Amazon Simple Notification Service (SNS) to internal systems or
administrators.
AWS CloudTrail logs provide administrative actions of your IoT
application.
Amazon CloudWatch is a monitoring service with integration with
AWS IoT Core and can trigger CloudWatch Events to automate security
responses. CloudWatch captures detailed logs related to
connectivity and security events between IoT edge components and
cloud services.
Infrastructure protection:
AWS IoT Core is a cloud service that lets connected devices easily
and securely interact with cloud applications and other devices.
The AWS IoT rules engine in
AWS IoT Core uses IAM permissions to communicate with other
downstream AWS services. AWS has created a wide selection of
industry leading IoT silicon vendors, device manufacturers, and
gateway partners who have integrated
AWS IoT Greengrass into their software and hardware offerings.
Customers have the option to store their device private key on a
hardware secure element and store sensitive device information at
the edge with
AWS IoT Greengrass Secrets Manager and encrypt secrets using
private keys for root of trust security.
Data protection:
AWS IoT Core includes encryption capabilities for devices over TLS
to protect your data in transit.
AWS IoT Core integrates directly with services, such as
Amazon S3 and
Amazon DynamoDB, which support encryption at rest. In addition,
AWS Key Management Service (KMS) supports the ability for you to create and
control keys used for encryption. On devices, you can use AWS edge
offerings such as
FreeRTOS,
AWS IoT Greengrass, or the AWS IoT Embedded C SDK to support secure
communication.
Patch management: Implement
patch management to fix device vulnerabilities and define
appropriate update mechanisms for software and firmware updates
using
AWS IoT Device Management Jobs service and
AWS Systems Manager Patch Manager. Perform deployment of
patches only after testing the patches in a test environment
before implementing them in production and verify the integrity of
the software before starting to run it making sure that it comes
from a reliable source (signed by the vendor) and that it is
obtained in a secure manner.
Incident response:
AWS IoT Device Defender allows you to create security profiles
that can be used to detect deviations from normal device behavior
and trigger automated responses including Serverless Computing
-AWS Lambda.
AWS IoT Device Management should be used to group devices that
need remediation and then using AWS IoT Jobs to deploy fixes to
devices.
AWS Security Hub can be used to aggregate security alerts from
various AWS services and partner products to help you analyze your
security trends and identify the highest priority security issues.
AWS Security Hub provides you with a comprehensive view of your
security state within AWS and your compliance with security
standards and best practices and enables automated remediation.
AWS Security Hub has out-of-the-box integrations with
ticketing, chat, Security Information and Event Management (SIEM),
Security Orchestration Automation and Response (SOAR), threat
investigation, Governance Risk and Compliance (GRC), and incident
management tools to provide users with a complete security
operations workflow.
Business continuity and
recovery: To backup IoT data at the edge and in the
cloud, customers can use
AWS IoT Greengrass stream manager to locally buffer data and send
data to local storage destinations and other life cycle management
features available in
AWS IoT Greengrass to support your data resiliency and backup
needs.
AWS Backup can be used to centrally manage and automate backups
across AWS services and on premise IoT systems.
