1. Conduct a formal security risk assessment using a common framework
Conduct a formal security risk assessment using a common
framework (such as
MITRE
ATT&CK
Whether you’re deploying consumer devices, industrial workloads,
or operational technologies, it is important to first evaluate the
risks and threats associated with your deployment. For example,
one common threat to IoT devices listed in the MITRE ATT&CK
framework is a
Network
Denial of Service (T1498)
-
Identify, manage, and track gaps and vulnerabilities. Create and maintain an up-to-date threat model that can be monitored against.
-
Segment systems based on their risk assessment. Some IoT and IT systems may share the same risks, so use a predefined zoning model with appropriate controls between them.
-
Follow a micro segmentation approach to isolate the impact of an event.
-
Use appropriate security mechanisms to control information flow between network segments.
-
Regularly identify and review security event minimization opportunities as your IoT system evolves.
Supporting AWS resources
When building your environment inside of AWS, foundational services such as Amazon Virtual Private Cloud (VPC), VPC security groups (SGs), and network access control lists (network ACLs) should be used to implement the micro segmentation. AWS recommends using multiple accounts, which helps to isolate IoT applications, data, and business processes across your environment and use AWS Organizations for better manageability and centralized insight. Additional information can be found in the Security Pillar of AWS Well-Architected Framework and Organizing Your AWS Environment Using Multiple Accounts whitepaper.