There are many challenges to monitoring your IoT system. For example, some devices may not generate security audit logs, and many devices do not support formats such as syslog. Gaining timely access to device log data can prove difficult, and the confidence in the integrity of IoT device audit logs may be limited, given minimal, if any, protection mechanisms applied to the logs. Even so, there are events that should be monitored within an IoT system. Any of these events on their own are not necessarily an indicator of compromise; however, security analysts should correlate events across the system to determine if further investigation is required. Some events to monitor within an IoT system include:
- Device not reachable
- Time-based anomalies
- Spikes in velocity, especially at odd times of the day
- Drops in velocity
- New protocols emanating or targeting an IoT device
- Variances in data collected past a threshold
- Authentication anomalies
- Attempted elevations of privilege
- Rapid change...