Practical Internet of Things Security Second Edition

Design a security framework for an Internet connected ecosystem, 2nd Edition

Brian Russell , Drew Van Duren 지음

Packt(GCO Science) 2018년 11월 30일 출간

작품소개

책소개

▶Book Description
With the advent of the Internet of Things (IoT), businesses have to defend against new types of threat. The business ecosystem now includes the cloud computing infrastructure, mobile and fixed endpoints that open up new attack surfaces. It therefore becomes critical to ensure that cybersecurity threats are contained to a minimum when implementing new IoT services and solutions. The interconnectivity of people, devices, and companies raises the stakes to a new level; as computing becomes ever more mobile, everything becomes connected to the cloud,and its infrastructure is hard put to it to securely manage the billions of devices that will connect us all to the IoT.

This book shows you how to implement cybersecurity solutions, IoT design best practices, and risk mitigation methodologies to address device and infrastructure threats to IoT solutions.

In this second edition, you will go through some typical and unique vulnerabilities seen within various layers of the IoT technology stack and also learn new ways in which IT and physical threats interact. You will then explore the different engineering approaches a developer/manufacturer might take to securely design and deploy IoT devices. Furthermore, you will securely develop your own custom additions for an enterprise IoT implementation. You will also be provided with actionable guidance through setting up a cryptographic infrastructure for your IoT implementations. You will then be guided on the selection and configuration of Identity and Access Management solutions for an IoT implementation. In conclusion, you will explore cloud security architectures and security best practices for operating and managing cross-organizational, multi-domain IoT deployments.

▶What You Will Learn
？ Discuss the need for separate security requirements and apply security engineering principles on IoT devices
？ Master the operational aspects of planning, deploying, managing, monitoring, and detecting the remediation and disposal of IoT systems
？ Use Blockchain solutions for IoT authenticity and integrity
？ Explore additional privacy features emerging in the IoT industry, such as anonymity, tracking issues, and countermeasures
？ Design a fog computing architecture to support IoT edge analytics
？ Detect and respond to IoT security incidents and compromises

▶Key Features
？ Learn best practices to secure your data from the device to the cloud
？ Use systems security engineering and privacy-by-design principles to design a secure IoT ecosystem
？ A practical guide that will help you design and implement cyber security strategies for your organization

▶Who This Book Is For
This book targets IT Security Professionals and Security Engineers (including pentesters, security architects and ethical hackers) who would like to ensure the security of their organization's data when connected through the IoT. Business analysts and managers will also find this book useful.

목차

▶TABLE of CONTENTS
1 A Brave New World
2 Vulnerabilities, Attacks, and Countermeasures
3 Approaches to Secure Development
4 Secure Design of IoT Devices
5 Operational Security Life Cycle
6 Cryptographic Fundamentals for IoT Security Engineering
7 Identity and Access Management Solutions for the IoT
8 Mitigating IoT Privacy Concerns
9 Setting Up an IoT Compliance Monitoring Program
10 Cloud Security for the IoT
11 IoT Incident Response and Forensic Analysis

책 속으로

▶What this book covers
？ Chapter 1, A Brave New World, introduces you to the basics of IoT, its definition, uses, applications, and implementations.

？ Chapter 2, Vulnerabilities, Attacks, and Countermeasures, takes you on a tour where you will learn about the various threats and the measures that we can take to counter them.

？ Chapter 3, Approaches to Secure Development, focuses on the different engineering approaches a developer/manufacturer might take to securely design and deploy IoT devices.

？ Chapter 4, Secure Design of IoT Devices, provides readers with the tools needed to securely develop their own custom additions to an enterprise IoT implementation.

？ Chapter 5, Operational Security Life Cycle, introduces a system security life cycle for the IoT that focuses on operational aspects related to the planning, deployment, management, monitoring and detection, remediation, and disposal of IoT systems.

？ Chapter 6, Cryptographic Fundamentals for IoT Security Engineering, provides a background on applied cryptography.

？ Chapter 7, Identity and Access Management Solutions for the IoT, dives deep into identity and access management for the IoT.

？ Chapter 8, Mitigating IoT Privacy Concerns, explores IoT privacy concerns. It will also help you to understand how to address and mitigate such concerns.

？ Chapter 9, Setting Up an IoT Compliance Monitoring Program, helps you to explore how to set up an IoT compliance program.

？ Chapter 10, Cloud Security for the IoT, explains the concepts of cloud security that are related to the IoT.

？ Chapter 11, IoT Incident Response and Forensic Analysis, explores incident management and forensics for the IoT.

출판사 서평

▶ Preface
Only a few people would contest the assertion that the phenomenon of the Internet of Things (IoT) poses problems related to security, safety, and privacy. Given the remarkable industrial and consumer diversity of the IoT, one of the principal challenges and goals we faced when electing to write this book was determining how to identify and distill the core IoT security principles in the most useful, but industry-agnostic, way possible. It was equally important to balance real-world application with background theory, especially given the unfathomable number of current and forthcoming IoT products, systems, and applications. To this end, we included some basic security (and safety) topics that we must adequately, if minimally, cover, as they are required as a reference point in any meaningful security conversation. Some of the security topics apply to devices (endpoints), some to communication connections between them, and others to the larger enterprise.

Another goal of this book was to lay out security guidance in a way that did not regurgitate the vast amounts of existing cyber security knowledge as it applies to today's networks, hosts, operating systems, software, and so on, although we realized that some is necessary for a meaningful discussion on IoT security. Not wanting to align with a single industry or company selling products, we strove to sufficiently carve out and tailor useful security approaches that encompass the peculiarities and nuances of what we think both distinguishes and aligns IoT with conventional cyber security.

A wide range of both legacy industries (for example, home appliance makers, toy manufacturers, and automotive manufacturers) and start-up technology companies are today creating and selling connected devices and services at a phenomenal and growing rate. Unfortunately, not all are terribly secure―a fact that some security researchers have unrelentingly pointed out, often with a sense of genuine concern. Though much of the criticism is valid and warranted, some of it has, unfortunately, been conveyed with a certain degree of unhelpful hubris.

What is interesting, however, is how advanced some of the legacy industries are with regard to high-assurance safety and fault-tolerant design. These industries make extensive use of the core engineering disciplines―mechanical, electrical, industrial, aerospace, and control engineering―and high-assurance safety design in order to engineer products and complex systems that are, well, pretty safe. Many cyber security engineers are frankly ignorant of these disciplines and their remarkable contributions to safety and fault-tolerant design.

Hence, we arrive at one of the serious obstructions that IoT imposes in terms of achieving its security goals: poor collaboration between the safety, functional, and security engineering disciplines needed to design and deploy what we term Cyber-Physical Systems (CPS). CPS put the physical and digital engineering disciplines together in ways that are seldom addressed in academic curricula or corporate engineering offices. It is our hope that engineers, security engineers, and all types of technology managers learn to better collaborate on the required safety and security-assurance goals.

While we benefit from the IoT, we must prevent our current and future IoT from harming us as far as possible; and to do this, we need to secure it properly and safely. We hope you enjoy this book and find the information useful as regards securing your IoT.

작가정보

저자(글) Brian Russell

Brian Russell is the founder of TrustThink, LLC, where he leads multiple efforts towards the development of trusted IoT solutions. He has over 20 years of information security experience and has led complex system security engineering programs in the areas of cryptographic modernization, cryptographic key management, unmanned aerial systems, and connected vehicle security. He is the co-chair of the Cloud Security Alliance (CSA) IoT Working Group and was the recipient of the 2015 and 2016 CSA Ron Knode Service Award. Brian is an adjunct professor at the University of San Diego (USD) in the Cyber Security Operations and Leadership program.

저자(글) Drew Van Duren

Drew Van Duren has provided 20 years of support to commercial and government customers in their efforts to secure safety-of-life and national security systems. He has provided extensive applied cryptographic design, key management expertise, and system security architecture design through rigorous integration of system security design with the core engineering disciplines. Drew has managed as Technical Director the two largest FIPS 140-2 test laboratories, security-consulted for the New York City Connected Vehicle Pilot Deployment, and participated in multiple standards groups such as the RTCA, SAE, and IEEE 1609 working group. Today, he supports the IEEE P1920 committee heading security architecture for unmanned aircraft aerial networks.