5 ms·

Suppose I want to design an IoT device with security in mind. How would I best go about doing that? I've been looking for a good source for best practices, but

Suppose I want to design an IoT device with security in mind. How would I best go about doing that? I've been looking for a good source for best practices, but most of what I've seen so far is hand-wavy or Amazon-centric.

ryandrake 6y ago
Here’s how I’d approach it: Step 1: Decide whether you actually need network connectivity for the main use case of whatever you are building. The answer will usually be no. Step 2: If the answer to step 1 was YES, then now decide if you need Internet access for the device’s main use case. The answer will almost always be no. Step 3: If the answer so both of the above was YES, finally decide if your device’s main use case requires you to build a server-side service, too. If the answer is NO, plan on investing a lot in security professionals. If the answer is YES (I’d be shocked), plan on spending an enormous amount on security professionals. Then listen to those professionals.
- coupdejarnac 6y ago
  I appreciate the input, but device and backend are nearly complete. I'm looking for concrete examples of how other people manage x509 certs.
  - banana_giraffe 6y ago
    Generally it involves some answer that doesn't wait till the device and backend are nearly complete. Security shouldn't be the last step of your equation. Snark aside, there are lots of white papers on x509 provision of devices, including IoT devices. Go read them.
    - Igelau 6y ago
      Built the product. No idea about best practices. Didn't read the white papers. Security built at the last minute by asking strangers on the Internet. IoT security/privacy concerns in a nutshell.
      - mkr-hn 6y ago
        On the plus side everyone who comes across this subthread will have it in mind the next time a friend talks about this great IoT idea they have. Better culture starts at the bottom with one person sharing a thought with another.
        coupdejarnac 6y ago
        It's a shining example of snark, condescension, and second guessing someone's use case. Better culture starts elsewhere.
        mkr-hn 6y ago
        You've gone off on several people now who got the exact same impression rather than accept maybe you're not a flawless communicator. You can't expect more charitable reads from others if you're not willing to be the first to give others the benefit of the doubt. This lashing out is definitely not going to convince people you thought about security in advance.
      - coupdejarnac 6y ago
        Excuse me, asshole. I've read plenty on the subject and spent significant resources on security, but I'm curious what other people here are doing. I don't appreciate all the snark.
        Igelau 6y ago
        > Excuse me, asshole. You're excused. > I don't appreciate all the snark. The article is a slam on the next generation of IoT devices. You might call it "snark" because you saw the word in The Guidelines, but it's healthy skepticism that's well on-topic for the thread. IoT encroachment is concerning and annoying for many of us. But good luck with your widget. Don't be a fool with your user's data. Let them use it in "dumb" mode. And thanks for giving me an excuse to read about the dueling exploits of Guy Chabot, Baron de Jarnac. With Love, Asshole
    - coupdejarnac 6y ago
      I really don't appreciate this response. Perhaps I've been overly brief about the background of the product's development, but a lot of effort has been put into security. I've read lots of documents about x509 provisioning. I am curious what people here are doing. Telling me to go read white papers is garbage response.
  - judge2020 6y ago
    AWS/GCP/Twilio/etc IoT or almost any other managed IoT service is going to be good for securing devices by only making outbound connections instead of accepting inbound ones. This reduces the attack surface to 'taking over an AWS account', ie. the Ubiquiti hack, which is better than regular IoT devices which have random UPnP-broadcasted open ports and, if they don't have reliable automatic updates, means vulnerability become the next target of a 0.0.0.0/0 network scan.
  - adrianN 6y ago
    Make the device accessible over a TOR hidden service only https://blog.torproject.org/quick-simple-guide-tor-and-internet-things-so-far https://blog.torproject.org/quick-simple-guide-tor-and-inter...
- codethief 6y ago
  As much as I appreciate the cynicism of your comment, it doesn't really answer OP's question which started off with: > Suppose I want to design an internet-of-things device with security in mind […] Meanwhile, half of your answer is spent discussing whether or not OP might need internet access, when in reality this is already a given. In short, you are talking about general "smart devices" but smart devices ⊋ IoT devices.
  - pavel_lishin 6y ago
    > Meanwhile, half of your answer is spent discussing whether or not OP might need internet access, when in reality this is already a given. Might be a case of the XY problem: https://en.wikipedia.org/wiki/XY_problem https://en.wikipedia.org/wiki/XY_problem OP's problem of "how do I secure my IoT device" might go away entirely if they don't actually need it to be an IoT device. But without some knowledge of what they're building and why, all we can do is guess.
    - ryandrake 6y ago
      Yea, that was the point, layered under a little snark. Time saved up front by relaxing the requirements so that you don't need a backend service or Internet means you don't even have to think about x509 provisioning.
      - coupdejarnac 6y ago
        Frankly, this thread would have been better off without your response. I don't need my use case second guessed because you have an ax to grind with other irresponsible IoT products.
    - coupdejarnac 6y ago
      Alternatively, you could take my question at face value. Let's assume I'm an engineer who isn't a complete imbecile who has given the issue some thought already.

ryandrake 6y ago

Here’s how I’d approach it: Step 1: Decide whether you actually need network connectivity for the main use case of whatever you are building. The answer will usually be no. Step 2: If the answer to step 1 was YES, then now decide if you need Internet access for the device’s main use case. The answer will almost always be no. Step 3: If the answer so both of the above was YES, finally decide if your device’s main use case requires you to build a server-side service, too. If the answer is NO, plan on investing a lot in security professionals. If the answer is YES (I’d be shocked), plan on spending an enormous amount on security professionals. Then listen to those professionals.

coupdejarnac 6y ago
I appreciate the input, but device and backend are nearly complete. I'm looking for concrete examples of how other people manage x509 certs.
- banana_giraffe 6y ago
  Generally it involves some answer that doesn't wait till the device and backend are nearly complete. Security shouldn't be the last step of your equation. Snark aside, there are lots of white papers on x509 provision of devices, including IoT devices. Go read them.
  - Igelau 6y ago
    Built the product. No idea about best practices. Didn't read the white papers. Security built at the last minute by asking strangers on the Internet. IoT security/privacy concerns in a nutshell.
    - mkr-hn 6y ago
      On the plus side everyone who comes across this subthread will have it in mind the next time a friend talks about this great IoT idea they have. Better culture starts at the bottom with one person sharing a thought with another.
      - coupdejarnac 6y ago
        It's a shining example of snark, condescension, and second guessing someone's use case. Better culture starts elsewhere.
        mkr-hn 6y ago
        You've gone off on several people now who got the exact same impression rather than accept maybe you're not a flawless communicator. You can't expect more charitable reads from others if you're not willing to be the first to give others the benefit of the doubt. This lashing out is definitely not going to convince people you thought about security in advance.
    - coupdejarnac 6y ago
      Excuse me, asshole. I've read plenty on the subject and spent significant resources on security, but I'm curious what other people here are doing. I don't appreciate all the snark.
      - Igelau 6y ago
        > Excuse me, asshole. You're excused. > I don't appreciate all the snark. The article is a slam on the next generation of IoT devices. You might call it "snark" because you saw the word in The Guidelines, but it's healthy skepticism that's well on-topic for the thread. IoT encroachment is concerning and annoying for many of us. But good luck with your widget. Don't be a fool with your user's data. Let them use it in "dumb" mode. And thanks for giving me an excuse to read about the dueling exploits of Guy Chabot, Baron de Jarnac. With Love, Asshole
  - coupdejarnac 6y ago
    I really don't appreciate this response. Perhaps I've been overly brief about the background of the product's development, but a lot of effort has been put into security. I've read lots of documents about x509 provisioning. I am curious what people here are doing. Telling me to go read white papers is garbage response.
- judge2020 6y ago
  AWS/GCP/Twilio/etc IoT or almost any other managed IoT service is going to be good for securing devices by only making outbound connections instead of accepting inbound ones. This reduces the attack surface to 'taking over an AWS account', ie. the Ubiquiti hack, which is better than regular IoT devices which have random UPnP-broadcasted open ports and, if they don't have reliable automatic updates, means vulnerability become the next target of a 0.0.0.0/0 network scan.
- adrianN 6y ago
  Make the device accessible over a TOR hidden service only https://blog.torproject.org/quick-simple-guide-tor-and-internet-things-so-far https://blog.torproject.org/quick-simple-guide-tor-and-inter...
codethief 6y ago
As much as I appreciate the cynicism of your comment, it doesn't really answer OP's question which started off with: > Suppose I want to design an internet-of-things device with security in mind […] Meanwhile, half of your answer is spent discussing whether or not OP might need internet access, when in reality this is already a given. In short, you are talking about general "smart devices" but smart devices ⊋ IoT devices.
- pavel_lishin 6y ago
  > Meanwhile, half of your answer is spent discussing whether or not OP might need internet access, when in reality this is already a given. Might be a case of the XY problem: https://en.wikipedia.org/wiki/XY_problem https://en.wikipedia.org/wiki/XY_problem OP's problem of "how do I secure my IoT device" might go away entirely if they don't actually need it to be an IoT device. But without some knowledge of what they're building and why, all we can do is guess.
  - ryandrake 6y ago
    Yea, that was the point, layered under a little snark. Time saved up front by relaxing the requirements so that you don't need a backend service or Internet means you don't even have to think about x509 provisioning.
    - coupdejarnac 6y ago
      Frankly, this thread would have been better off without your response. I don't need my use case second guessed because you have an ax to grind with other irresponsible IoT products.
  - coupdejarnac 6y ago
    Alternatively, you could take my question at face value. Let's assume I'm an engineer who isn't a complete imbecile who has given the issue some thought already.