IoT Security Assessment

🚀 𝐍𝐞𝐰 𝐏𝐮𝐛𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧! 𝐈𝐧𝐭𝐞𝐠𝐫𝐚𝐭𝐢𝐧𝐠 𝐭𝐡𝐞 𝐂𝐑𝐀 𝐢𝐧𝐭𝐨 𝐭𝐡𝐞 𝐈𝐨𝐓 𝐋𝐢𝐟𝐞𝐜𝐲𝐜𝐥𝐞: 𝐂𝐡𝐚𝐥𝐥𝐞𝐧𝐠𝐞𝐬, 𝐒𝐭𝐫𝐚𝐭𝐞𝐠𝐢𝐞𝐬, 𝐚𝐧𝐝 𝐁𝐞𝐬𝐭 𝐏𝐫𝐚𝐜𝐭𝐢𝐜𝐞𝐬 Proud to share our newest peer-reviewed article in Information (MDPI), co-authored with Miguel Ángel Ortega Velázquez, Iris Cuevas Martinez, and Dr. Antonio J. Jara (myself as ISACA CISM/CISA/AAIA). 𝘛𝘩𝘪𝘴 𝘸𝘰𝘳𝘬 𝘢𝘳𝘳𝘪𝘷𝘦𝘴 𝘢𝘵 𝘢 𝘤𝘳𝘶𝘤𝘪𝘢𝘭 𝘮𝘰𝘮𝘦𝘯𝘵, 𝘢𝘴 𝘵𝘩𝘦 𝘌𝘜 𝘊𝘺𝘣𝘦𝘳 𝘙𝘦𝘴𝘪𝘭𝘪𝘦𝘯𝘤𝘦 𝘈𝘤𝘵 (𝘊𝘙𝘈) 𝘣𝘦𝘤𝘰𝘮𝘦𝘴 𝘵𝘩𝘦 𝘮𝘰𝘴𝘵 𝘪𝘮𝘱𝘢𝘤𝘵𝘧𝘶𝘭 𝘳𝘦𝘨𝘶𝘭𝘢𝘵𝘪𝘰𝘯 𝘧𝘰𝘳 𝘐𝘰𝘛 𝘮𝘢𝘯𝘶𝘧𝘢𝘤𝘵𝘶𝘳𝘦𝘳𝘴 𝘪𝘯 𝘵𝘩𝘦 𝘤𝘰𝘮𝘪𝘯𝘨 𝘺𝘦𝘢𝘳𝘴. 🔥 𝐓𝐨𝐩 𝐓𝐚𝐤𝐞𝐚𝐰𝐚𝐲𝐬 1️⃣ 𝐀 𝐜𝐨𝐦𝐩𝐥𝐞𝐭𝐞 𝐦𝐞𝐭𝐡𝐨𝐝𝐨𝐥𝐨𝐠𝐲 𝐭𝐨 𝐜𝐨𝐧𝐯𝐞𝐫𝐭 𝐥𝐞𝐠𝐚𝐥 𝐂𝐑𝐀 𝐭𝐞𝐱𝐭 𝐢𝐧𝐭𝐨 𝐞𝐧𝐠𝐢𝐧𝐞𝐞𝐫𝐢𝐧𝐠 𝐫𝐞𝐚𝐥𝐢𝐭𝐲: We introduce a two-phase framework: • Phase 1: Systematically transform CRA Articles 13–14 and Annexes into atomic, testable engineering requirements. • Phase 2: Apply Analytic Hierarchy Process (AHP) quantitative scoring to produce a defensible readiness metric. 2️⃣ 𝐀 𝐟𝐮𝐥𝐥 𝐥𝐢𝐟𝐞𝐜𝐲𝐜𝐥𝐞-𝐛𝐚𝐬𝐞𝐝 𝐂𝐑𝐀 𝐜𝐡𝐞𝐜𝐤𝐥𝐢𝐬𝐭 𝐟𝐨𝐫 𝐈𝐨𝐓 𝐩𝐫𝐨𝐝𝐮𝐜𝐭𝐬: From secure design to post-market obligations, the paper provides an actionable DevSecOps-aligned checklist. 3️⃣ 𝐀 𝐝𝐞𝐟𝐞𝐧𝐬𝐢𝐛𝐥𝐞 𝐫𝐢𝐬𝐤-𝐛𝐚𝐬𝐞𝐝 𝐰𝐞𝐢𝐠𝐡𝐭𝐢𝐧𝐠 𝐦𝐨𝐝𝐞𝐥 𝐮𝐬𝐢𝐧𝐠 𝐭𝐡𝐞 𝐀𝐧𝐚𝐥𝐲𝐭𝐢𝐜 𝐇𝐢𝐞𝐫𝐚𝐫𝐜𝐡𝐲 𝐏𝐫𝐨𝐜𝐞𝐬𝐬 (𝐀𝐇𝐏): We derive consistent domain weights, ensuring mathematically validated prioritization of CRA domains. 4️⃣ 𝐑𝐞𝐚𝐥-𝐰𝐨𝐫𝐥𝐝 𝐯𝐚𝐥𝐢𝐝𝐚𝐭𝐢𝐨𝐧 through the TRUEDATA project funded by INCIBE - Instituto Nacional de Ciberseguridad: We applied the full model to a large industrial OT cybersecurity project (water infrastructure) with Neoradix Solutions AirTrace Bersey UCAM Universidad Católica San Antonio de Murcia at the pilots with the support of the Confederación Hidrográfica del Segura, O.A., Mancomunidad De Los Canales De Taibilla, and FRANCISCO ARAGÓN. 5️⃣ 𝐂𝐥𝐞𝐚𝐫 𝐨𝐩𝐞𝐫𝐚𝐭𝐢𝐨𝐧𝐚𝐥 𝐠𝐮𝐢𝐝𝐚𝐧𝐜𝐞. The paper provides best practices for SBOM automation, PSIRT & CVD setup, Secure-by-design, OTA, monitoring, attestation, documentation and conformity assessment Our aim from Libelium with this paper is to give the industry a practical, structured, and evidence-based way to operationalize compliance and strengthen cybersecurity by design. 𝐓𝐑𝐔𝐄𝐃𝐀𝐓𝐀 𝐝𝐞𝐦𝐨𝐧𝐬𝐭𝐫𝐚𝐭𝐞𝐬 𝐡𝐨𝐰 𝐭𝐡𝐞 𝐦𝐞𝐭𝐡𝐨𝐝𝐨𝐥𝐨𝐠𝐲 𝐚𝐩𝐩𝐥𝐢𝐞𝐬 𝐭𝐨 𝐡𝐢𝐠𝐡-𝐬𝐭𝐚𝐤𝐞𝐬 𝐢𝐧𝐝𝐮𝐬𝐭𝐫𝐢𝐚𝐥 𝐬𝐲𝐬𝐭𝐞𝐦𝐬. 𝐓𝐡𝐞 𝐂𝐑𝐀 𝐢𝐬 𝐧𝐨𝐭 “𝐣𝐮𝐬𝐭 𝐚𝐧𝐨𝐭𝐡𝐞𝐫 𝐫𝐞𝐠𝐮𝐥𝐚𝐭𝐢𝐨𝐧”, 𝐢𝐭 𝐢𝐬 𝐭𝐡𝐞 𝐧𝐞𝐰 𝐛𝐚𝐬𝐞𝐥𝐢𝐧𝐞 𝐟𝐨𝐫 𝐈𝐨𝐓 𝐭𝐫𝐮𝐬𝐭 𝐢𝐧 𝐄𝐮𝐫𝐨𝐩𝐞. 👉 Download here: https://lnkd.in/dQu54qE2 European Union Agency for Cybersecurity (ENISA) Felix A. Barrio (PhD, CISM) Global Cybersecurity Forum SITE سايت Betania Allo Axon Partners Group ISACA ISACA VALENCIA

Current IoT risk assessments are broken—and here’s how to fix them courtesy of new research… As IoT systems grow more complex, traditional risk models fail to account for the cascading, interconnected threats these devices introduce. The research from this paper highlights that IoT risks aren’t isolated incidents; they’re part of a web of dependencies where one device's vulnerability can trigger widespread system failures. If you are in manufacturing or healthcare, this is a significant challenge. The authors propose a dependency-based cyber risk model to capture the interdependencies between IoT components and estimate how risks in one part of the system can affect the whole. The model uses AI/ML techniques for real-time risk estimation, making it adaptable across various IoT domains like healthcare, smart cities, and industrial IoT. It also integrates risk transference strategies, such as cyber insurance, to help organizations mitigate financial losses from cyber incidents. Key takeaway? The old ways of assessing cyber risk don’t work for IoT. The proposed model offers a dynamic, scalable approach to understanding and managing IoT-specific risks, and it’s time we embrace these more holistic strategies before it's too late. 74 pages...but well worth the read if IoT security is on your radar. #cybersecurity #IoT #risk #ai Claroty Upa Campbell

To ensure secure IoT communications and transactions, it is essential to understand potential threats, strengthen device security, use encryption, manage identities and access, segment networks, establish security policies, and continuously assess and mitigate risks. Understanding Threats Comprehending threats such as DDoS attacks, Man-in-the-Middle (MitM) attacks, and malware infections is crucial for implementing robust cybersecurity measures to protect IoT devices and the data they handle. Strengthening Device Security Implement robust authentication mechanisms, regular security updates, and secure configurations for IoT devices to ensure that only authorized users and devices access the network and that vulnerabilities are minimized. Using Encryption Utilize encryption for data in transit with protocols like TLS, and for data at rest to ensure that sensitive information is protected from unauthorized access and interception during transmission and storage. Managing Identities and Access Implement Role-Based Access Control (RBAC) and maintain comprehensive monitoring and logging of all activities to manage user permissions and quickly detect and respond to suspicious behavior within the IoT ecosystem. Segmenting Networks Isolate IoT devices from the main network and use firewalls along with Intrusion Detection/Prevention Systems (IDS/IPS) to limit the potential impact of any security breaches, keeping the overall network secure. Establishing Security Policies Educate employees on the importance of IoT security and best practices, and have a defined incident response plan to ensure the organization is prepared to handle security threats effectively and efficiently. Continuous Risk Assessment Conduct regular risk assessments and implement a vulnerability management program to identify, evaluate, and address security weaknesses in IoT devices, maintaining a proactive security posture. #IoT #Cybersecurity #DataProtection Ring the bell to get notifications 🔔

Arm PSA Certified 2024 Security Report found that security is a rising team priority. To help you better comply with security regulations, here are a few recommendations from interviewing Memfault CEO François Baldassari: 1) Implement Secure OTA Updates Ensure that your IoT device supports secure over-the-air (OTA) updates with signed firmware. This is critical for addressing vulnerabilities and complying with regulations that mandate the ability to update devices remotely. 2) Encrypt All Communications Encrypt all data transmitted to and from the IoT device. This protects against unauthorized access and is a key requirement in both the Cyber Resilience Act (CRA) in the EU and the Cyber Trust Mark in the US. 3) Maintain a Software Bill of Materials (SBOM) Keep an up-to-date record of all software components and dependencies used in your device, including their versions and known vulnerabilities. Regularly check this against a vulnerability database to ensure any issues are promptly addressed. 4) Monitor and Track Device Behavior Implement observability in your IoT devices by monitoring network traffic, IP connections, and other key metrics. This helps in detecting anomalies that could indicate security breaches or vulnerabilities. 5) Engage with Security Best Practices and Standards Stay informed and align your practices with recognized security frameworks like PSA Certified from ARM. Engage with open-source communities and leverage security-focused tools and libraries to ensure your device meets regulatory requirements. Are you and your team ready for IoT Security Compliance? Drop me a line to let me know the techniques you use to comply. - - - P.S. If you'd like to go deeper into this topic, check out my conversation with Memfault CEO François Baldassari on "Are Embedded Manufacturers Ready for IoT Security Compliance Demands" at https://lnkd.in/gcWiq9c3 or use your favorite podcast app and find "The Embedded Frontier."

Secure critical IoT/PT and ICS deployments with device and network security testing including breach and attack simulation - Securing critical infrastructure including ICS/OT and IIoT/IoT deployments requires solutions that emulates cyberattacks to protect connected devices and the networks of which they are connected. Safety, up-time/continuity and security, are critical for organizations operating large fleets of mission-critical connected devices, such as manufacturing, complex global and regional operations, healthcare and utilities. Yes, device manufacturers are responsible for security fixes, however these typically lag actual risks/attacks and zero days…enterprises need time to take vulnerable devices offline or replace them before they are compromised. Often these updates must be tested…and tested over time. Our personal experience is that some of these updates can be mission affecting with negative results. Therefore, testing networks and devices against multi-stage attacks — including ransomware infections, lateral movement, phishing attempts, protocol fuzzing, and data exfiltration — is vital. BLUF: To harden IIoT/IoT devices, use a device security test tool to subject them to low-level protocol fuzzing and upper-layer application attacks. Thoroughly test chipsets and network stacks to find flaws in Ethernet, Wi-Fi®, Bluetooth®, Bluetooth® Low Energy, LoRa, CAN bus, and cellular interfaces. Utilize specialized field and lab testing for OT devices that can ‘break’ if tested see our blogs on OT/ICS testing. At the same time, network security teams must continuously assess firewalls, endpoint security, and properly correlated SIEM/SOAR tools to prevent configuration drift and detect alerts. Use a breach and attack simulation(s) tool(s) to emulate multi-stage network attacks, reveal gaps in coverage, and identify remediations. Without these, security tool updates can inadvertently cause blind spots or vulnerabilities. Critical infrastructure and IIoT/IoT deployment security solutions require enterprises to secure critical OT/ICS/IIot/IoT deployments with both manual (RedTeam/PurpleTeam) and automated security testing and breach and attack simulation. These ideally should emulate multi-stage cyberattacks with your teams, scan for vulnerabilities, and mitigate risk with a systematic and  ever-expanding list of security assessments, audits, and test plans. Harden networks, protect connected devices, and stay ahead of emerging threats with Cyberleaf Defense in Depth and Pen Testing designed for your IoT and Critical Infrastructure Security Assessment.   If you like this post – please follow Cyberleaf on LinkedIn https://lnkd.in/e6txch76 and contact us directly for free assessments and a real conversation on Cyber Security.   Be safe out there!  

IoT devices are often overlooked during security testing. ISP Security LLC was on a recent engagement, we found a network-connected device with outdated firmware, unnecessary services exposed, and a weak local web management portal. The biggest risk wasn’t just the device. It was sitting on the same flat network as critical business systems. If that device were compromised, it could become a foothold for an attacker to move deeper into the environment. That’s why IoT penetration testing needs to look beyond the device itself and review the full ecosystem: Device security Firmware Network communication Web interfaces Mobile apps APIs Cloud connections Data handling Network segmentation Can this device be hacked? What can an attacker reach if this device is compromised? If it connects to your network, collects data, or talks to the cloud, it should be part of your security testing strategy. #IoTSecurity #PenetrationTesting #Cybersecurity #InfoSec #ISPSecurity