SYS.4.4 General IoT Devices

IoT devices MUST have update functions. The respective manufacturers MUST provide an update process. The devices MUST allow for appropriate authentication. Hard-coded access data MUST NOT be present in the devices.

Appropriate authentication MUST be activated. IoT devices MUST be integrated into the corresponding organisation's identity and access management system.

The network access of IoT devices MUST be restricted to the required minimum. This SHOULD be monitored regularly. The following aspects should be taken into consideration in this regard:

• For traffic control at network gateways (e.g. by means of rules on firewalls and access control lists (ACLs) on routers), the incoming and outgoing connections permitted MUST be defined in advance.
• Routings on IoT devices and sensors SHOULD be configured restrictively, especially with regard to the suppression of default routes.
• IoT devices and sensors SHOULD be operated in a separate network segment that is only allowed to communicate with the network segment for management.
• Virtual private networks (VPNs) between networks with IoT devices, sensor networks, and management networks SHOULD be configured restrictively.
• The UPnP feature MUST be disabled on all routers.

Requirements for IoT devices SHOULD be specified in organisations' general security policies. This policy SHOULD be known to all persons who procure and operate IoT devices and be integral to their work. The implementation of the rules required by the policy SHOULD be reviewed regularly and the results documented in a sensible way.

To ensure secure operation of IoT devices, where and how these devices should be used SHOULD be planned in advance. Besides addressing aspects usually associated with information security in the traditional sense, this planning SHOULD also consider normal operational aspects that entail requirements in the area of security. All decisions taken in the planning phase SHOULD be documented appropriately.

The CISO SHOULD also be involved in procuring IoT devices that do not have any obvious IT functionality. Prior to procuring IoT devices, the security requirements they must meet SHOULD be specified. When procuring IoT devices, aspects of material security and requirements regarding the security characteristics of the devices' software SHOULD be sufficiently considered. A requirements list SHOULD be drawn up that can be used to evaluate the products available on the market.

A person SHOULD be put in charge of the operation of every IoT device. The persons in charge SHOULD be appropriately informed about handling their IoT devices.

The framework conditions applicable to the installation and configuration of IoT devices SHOULD be defined. IoT devices SHOULD only be installed and configured by authorised persons (persons in charge of IoT devices, administrators, or service providers bound by contracts) in accordance with a defined process. All installation and configuration steps SHOULD be documented such that they can be understood and repeated by a qualified third party based on the documentation.

The basic settings of IoT devices SHOULD be checked and, where necessary, adapted to the specifications of the security policy in question. If possible, IoT devices SHOULD only be connected to data networks after installation and configuration are complete.

IoT devices SHOULD only transfer encrypted data.

Once IoT devices have been installed, the protocols, applications, and other tools that have been installed and enabled on them SHOULD be checked. Protocols, services, user IDs, and interfaces that are not required SHOULD be disabled or uninstalled entirely. The use of wireless interfaces that are not needed SHOULD be prevented.

If this is not possible using the device itself, services that are not required SHOULD be restricted using the corresponding firewall. The decisions taken SHOULD be documented such that the configurations selected for IoT devices can be determined.

Access authorisations for IoT devices SHOULD be granted as restrictively as possible. If this is not possible using IoT devices themselves, it SHOULD be considered via the network.

The IT Operation Department SHOULD regularly obtain information as to whether the IoT devices used could become infected with malware and how it can be removed. Malware SHOULD be eliminated immediately. If the cause of an infection cannot be eliminated or a new infection cannot be effectively prevented, the affected IoT devices SHOULD no longer be used.

Whether IoT devices or sensor systems communicate only with IT systems that are necessary for their operation SHOULD be monitored.

Security-relevant events SHOULD be logged automatically. If this is not possible using IoT devices themselves, routers and logging mechanisms of other IT systems SHOULD be used. The log data SHOULD be evaluated appropriately.

Depending on whether IoT devices are administered locally; directly using the respective network; or using central, network-based tools, appropriate security precautions SHOULD be taken. Access to the administration interfaces of IoT devices SHOULD be restricted as follows:

• Network-based administration interfaces SHOULD be limited to authorised IT systems or network segments.
• Preference SHOULD be given to local administration interfaces on IoT devices or administration interfaces via local networks.

The methods used for administration SHOULD be defined in the corresponding security policy. IoT devices SHOULD be administered according to this security policy.

There SHOULD be an overview of the data stored in each location on IoT devices. A checklist which can be completed when decommissioning IoT devices SHOULD be created. This checklist SHOULD, at minimum, include aspects of backing up data that is still needed and the subsequent secure deletion of all data.

It SHOULD be clarified whether IoT devices may be operated in the intended operational environment (i.e. taking the protection needs of other IT systems and data protection into account). IoT devices SHOULD be protected against theft, destruction, and manipulation in their operational environment.

It SHOULD be clarified whether an IoT device has certain requirements regarding its physical operational environment (e.g. humidity, temperature, energy supply). If required, additional safeguards SHOULD be implemented regarding the infrastructure at hand.

If IoT devices are operated using batteries, a procedure SHOULD be specified for regular functional testing and replacement of the batteries.

IoT devices SHOULD be protected against dust and pollution in accordance with their intended type and place of use.

IoT devices SHOULD be integrated into an appropriate system monitoring concept. This concept SHOULD continuously monitor the system status and functionality of the IoT devices in use and report error states and threshold violations to the respective operating personnel. Whether the devices used meet the availability requirements at hand SHOULD be checked. Alternatively, it SHOULD be checked whether further safeguards are required, such as setting up a cluster or procuring standby devices.

All IoT devices in use SHOULD be checked at regular intervals.

Web servers integrated into IoT devices SHOULD be configured as restrictively as possible. Whenever possible, a web server of this kind SHOULD NOT be operated using a privileged account.