Hello, everybody, welcome to this course on IoT security.
I would like in this lesson to begin mentioning some standards and guidelines for IoT security.
First of all, a little bit about myself, I'm an electronic engineer, I deal with IT security
and digital forensics, I've
achieved various IT certifications, such as the EC-Council CEH, the Computer Hacking Forensic Investigation
certification, the CompTia Security+ and some other.
So, let's start with some standards and guidelines for Iot security.
I have summarized some of the best known standards and guidelines for IoT security in this slide.
And let's try to detail some of them.
First of all, some words about the Enisa baseline security recommendation for IoT. ENISA is
a European Union agency for network and information security.
And you can download this document from the Enisa website.
The document is a security recommendation for IoT systems, and we can see from the summary that it
fully deals with the issue of security in the IoT world.
In fact, it describes in chapter two the elements of IoT system.
So the general architecture of IoT system.
And it describes in Chapter three some critical attack scenarios.
And you can also find common policies for IoT systems in Chapter four and four dot three describes
technical measures about hardware security, about the system safety and reliability, authentication
authorization mechanism, etc..
So it's fully describes security recommendation for IoT systems, so read it, take a look at this document
is strongly recommended to deepen the topic.
Oh, this table from from the mentioned document, for example, is taken from Chapter four and it
describes threat and risk analysis.
We will see later in the course a typical architecture of IoT system.
The slide shows the typical attacks on the components of the architecture.
So, for example, against sensors, modifying the values read by them or their threshold values
and settings.
And for this risk the importance level is high-crucial. Against the administration system of
IoT, Exploiting protocol vulnerabilities, with importance level of high, etc..
You can also from Enisa, you can also download the guidelines for the secure development of software
for the IoT.
And so practices for security of IoT secure software development lifecycle.
And another important document is the GSMA IoT security guidelines
The collection of these documents includes four documents.
First of all, a general overview document, and you can also take a look at IoT security guidelines
document for the service ecosystem, one for the end point, Eco-System and a document of security
guidelines for network operators.
.
In this slide, we can see the table of contents of the IoT security guidelines for IoT service ecosystem,
and as you can see, you can find at Chapter five critical recommendations and how to define an
organizational root of trust, how to define an administration model, system logging and monitoring
approach, etc..
You can also find at Chapter six high priority recommendation.
The next chapter describes medium priority recommendation.
And so on
And.
Iot Security Foundation also has developed a number of documents, including the IoT security compliance
framework, that it's described in this slide, and it's about a comprehensive checklist to guide an organization
through the Iot security assurance process
And you can download these documents.
And this framework can be used by the Iot security auditors to evaluate the adherence of Iot systems
to the framework, thus identifying any anomalies and gaps.
This is an extract from the table of contents of this document.
Lastly, deserves mention the series of ISA/IEC 62443 standards for
the world of industrial automation and control systems.
So you can also take a look at this site and download these series of documents.
So thank you for your kind attention.