Book Image

Practical Industrial Internet of Things Security

By : Sravani Bhattacharjee
Book Image

Practical Industrial Internet of Things Security

By: Sravani Bhattacharjee

Overview of this book

Securing connected industries and autonomous systems is of primary concern to the Industrial Internet of Things (IIoT) community. Unlike cybersecurity, cyber-physical security directly ties to system reliability as well as human and environmental safety. This hands-on guide begins by establishing the foundational concepts of IIoT security with the help of real-world case studies, threat models, and reference architectures. You’ll work with practical tools to design risk-based security controls for industrial use cases and gain practical knowledge of multi-layered defense techniques, including identity and access management (IAM), endpoint security, and communication infrastructure. You’ll also understand how to secure IIoT lifecycle processes, standardization, and governance. In the concluding chapters, you’ll explore the design and implementation of resilient connected systems with emerging technologies such as blockchain, artificial intelligence, and machine learning. By the end of this book, you’ll be equipped with the all the knowledge required to design industry-standard IoT systems confidently.
Table of Contents (22 chapters)
Title Page
Copyright and Credits
Dedication
Packt Upsell
Foreword
Contributors
Disclaimer
Preface
I
I
Index

Security standards – quick reference


Standards related to Industrial IoT security discussed in this book are summarized here for quick referenence.

Device endpoint security

  • CWE: Common Weakness Enumeration
  • FIPS 140-2: Security Requirements for Cryptographic Modules
  • FIPS 180-4: NIST-CSRC Secure Hash Standard (SHS)
  • ISO/IEC 197702: Specification on Software Tagging
  • ISA 62443-1-1: Security for Industrial Automation and Control Systems Part 1 – Terminology, Concepts, and Models
  • ISA/IEC 62443-3-3: Security for Industrial Automation and Control Systems Part 3-3 – System Security Requirements and Security Levels
  • ISO/IEC 15408: Common Criteria for Information Technology Security Evaluation
  • NIST SP 800-155: Boot-process integrity measurement
  • NIST SP 800-53: Security and Privacy Controls for Federal Information Systems and Organizations

Industrial connectivity infrastructure security

  • ISA95: Purdue Enterprise Reference Architecture Enterprise-Control System Integration
  • ISA-99: Industrial Automation and Control Systems Security (https://www.isa.org/isa99/)
  • IEC 62443: Industrial Network and System Security
  • IEC 62541: OPC Unified Architecture Specification
  • IEC 61850: Substation Automation Protocols
  • IEEE 1588: IEEE Standard for a Precision Clock Synchronization Protocol for Network Measurement and Control Systems
  • NIST SP 800-53 Rev 4: Recommended Security and Privacy Controls for Federal Information Systems and Organizations
  • NIST SP 800-82 Rev 2: Guide to Industrial Control Systems (ICS) Security, May 2015
  • NIST SP 800-52: Guidelines on the Selection and Use of Transport-Layer Security
  • TIA-942-A (http://www.tia-942.org/): ANSI/TIA-942-A: Telecommunications Infrastructure Standard for Datacenters (http://blog.siemon.com/standards/tia-942-and-tia-942-a-%E2%80%9Cdata-center-infrastructure%E2%80%9D-standards)

Edge-cloud security

  • ISO/IEC 27001: A high-level management systems standard and its associated cloud-service-specific standards: ISO/IEC 27017 (for security) and ISO/IEC 27018 (for protection of personal data)
  • Standards addressing specific aspects of cloud computing: ISO/IEC 27033 for network security, ISO/IEC 27034 for application security, ISO/IEC 19086 for cloud service SLAs
  • Technology-specific security standards: Such as OASIS KMIP (key management), FIPS 140-2 (approved cryptographic modules), and OASIS SAML 2.0 (security assertions, used in IdAM implementations)
  • ISO/IEC 20889: Standardizes de-identification techniques
  • US National Institute of Standards and Technology (NIST) Special Publication 800-175B: Provides guidance on strong cryptographic methods
  • NIST SP 800-144: Guidelines on Security and Privacy in Public Cloud Computing

 

 

Some useful documents on cloud security include the following: