ENISA物联网安全基线：关键信息基础设施指南

需积分: 9 133 浏览量更新于2024-07-18 1 收藏 4.05MB PDF 举报

"欧洲网络与信息安全局发布了一份物联网在关键信息基础设施领域安全基线的推荐指南，该指南为理解和加强物联网安全提供了重要参考。" 物联网（IoT）在关键信息基础设施（CIIs）中的应用日益广泛，这使得网络安全问题变得至关重要。欧洲网络与信息安全局（ENISA）作为欧盟的网络安全专业知识中心，致力于与欧盟成员国、私营部门和公民合作，提供信息安全管理的建议和指导。ENISA的工作重点包括协助成员国执行相关欧盟法规，提高欧洲关键信息基础设施和网络的韧性。这份2017年11月发布的物联网安全基线推荐指南，主要关注在关键信息基础设施环境下的物联网安全，旨在为相关领域提供基础安全措施。指南可能涵盖了以下关键知识点： 1. **风险评估**：物联网设备可能带来的潜在威胁和风险，以及如何进行有效的风险评估和管理，确保关键基础设施不受恶意攻击或破坏。 2. **设备安全**：物联网设备的安全设计原则，包括固件更新机制、安全认证、隐私保护和数据加密等，以防止未经授权的访问和滥用。 3. **网络架构安全**：设计和实施安全的物联网网络架构，包括网络分段、访问控制策略和边界防护措施，以降低攻击面。 4. **数据保护**：物联网产生的大量数据如何安全存储和传输，遵循数据保护法规，如GDPR，保护用户隐私和企业敏感信息。 5. **供应链安全**：确保物联网设备和组件在整个供应链过程中的安全，包括供应商审核、供应链风险管理及安全标准的实施。 6. **监测和响应**：建立有效的监控系统，快速检测异常行为，制定应急响应计划，以便在遭受攻击时迅速恢复。 7. **合规性**：物联网安全措施应符合欧盟和其他相关国家的法律法规，如NIS指令（网络和信息系统指令），确保组织的合法性和合规运营。 8. **持续改进**：强调了对物联网安全实践的持续审查和改进，通过学习和适应新的威胁，保持系统的安全性。 9. **跨边界合作**：促进欧盟成员国之间的合作，建立共享威胁情报和最佳实践的社区，共同提升整个地区的网络和信息安全性。通过这份指南，读者可以深入了解物联网在关键信息基础设施中的安全挑战，并获取实施有效安全措施的实用建议。欲了解更多ENISA的相关工作和资源，可访问其官方网站www.enisa.europa.eu。

Baseline Security Recommendations for IoT

in the context of Critical Information Infrastructures

November 2017

Methodology

This study was carried out using a five-step methodology (shown in Figure 1) which begins with the scope

definition, the initial information gathering from official sources and experts in the field and ends in the

development of a report summarizing the findings and the recommendations to the target audience.

Figure 1: Methodology followed in the study

1. Scope definition and identification of experts: The first step was to establish the report’s scope and

perimeter and then to identify the IoT experts, so as to gather their input and knowledge in relation to

the objectives of this report.

2. Desktop research: In parallel with the expert identification, an investigation was carried out to identify

existing publications and information on the topics related to the objectives of the report, which will

serve as support for the analysis of the threats and for the development of the security measures.

3. Collection of stakeholders’ and experts’ point of view: A series of interviews were conducted with the

experts from the IoTSEC Experts Group, using an internally developed questionnaire to guide them and

to ensure that we obtained the most relevant input.

4. Analysis and development: The results from the desktop research and the interviews were analysed and

contrasted to align them with the objectives of the report, developing the assets and threats taxonomies

and identifying the attack scenarios, as well as identifying the baseline security measures, the gaps and

the recommendations to address them.

5. Report write-up and validation: The last step was to synthesise all the findings from the desktop research

and the interviews with the experts, shaping this report, which was finally validated in the workshop

meeting with the IoT experts that have collaborated in the study.

Structure

The rest of the report is structured as follows:

 Chapter 1: Introduction to the report and definition of the objective and the methodology followed to

achieve it.

 Chapter 2: Definition and documentation about IoT key elements and environments.

 Chapter 3: Analysis of the main threats, vulnerabilities, risks and the development of the main attack

scenarios.

 Chapter 4: Development, mapping and categorisation of the main security measures that have been

identified and that apply in the scope of the report.

 Chapter 5: Gaps and future challenges applicable to the scope of the project.

•SScope definition and

identification of experts

Task 1

•Desktop

research

Task 2

•Collection of the

stakeholders' and experts'

point of view

Task 3

•Analysis and

development

Task 4

•Report write-up

and validation

Task 5

Baseline Security Recommendations for IoT

in the context of Critical Information Infrastructures

November 2017

2. The IoT paradigm

ENISA defines IoT as “a cyber-physical ecosystem of interconnected sensors and actuators, which enable

intelligent decision making”. Stemming from the definition is the fact that information lies at the heart of

IoT, feeding into a continuous cycle of sensing, decision making, and actions.

Figure 2: IoT pervasive ecosystem

Figure 2 illustrates the pervasive nature of IoT in that it is at the core of a plethora of both critical and non-

critical infrastructures. IoT is pertinent to almost all aspects of daily life, affecting commercial applications,

the industrialisation, or the private sphere, to name a few. Inherently, IoT builds on embedding “intelligence”

in everyday objects, thus increasing the usefulness of what used to be common “things”, and therefore

facilitating all aspects of daily life by providing a greater automation and control in sectors such as industry,

energy, transport, health, retail, etc. The majority of the sectors associated with IoT are critical, and any

incident affecting them can thus severely affect society as a whole.

Industry 4.0 and Industrial Internet of Things (IIoT) are frequently and rightfully associated with IoT focusing

on digitising industries

. Industry 4.0 is the term coined to refer to the world’s fourth industrial revolution

It is defined as the brisk transformation in the design, manufacture, operation and service of manufacturing

systems and products, where digital technology and the Internet merge together with the conventional

industry, achieving digitally connected manufacturing operations with a highly integrated value chain

. In

this study, we focus on the more generic concept of IoT.

This chapter will provide a brief insight into the IoT elements and architecture, including the different

security considerations to be taken into account.

See EPRS, Ron Davies, «Industry 4.0», http://www.europarl.europa.eu/RegData/etudes/BRIE/2015/568337/EPRS_BRI(2015)568337_EN.pdf

Baseline Security Recommendations for IoT

in the context of Critical Information Infrastructures

November 2017

Elements of IoT

The following sections provide an overview of the different elements that shape the IoT ecosystem, namely

the Things in the IoT, intelligent decision making, sensors and actuators, communications and embedded

systems. A detailed IoT asset taxonomy can be found later in chapter 2.5.

2.1.1 Things in the Internet of Things

In IoT environments, a thing is a physical or virtual object capable of being identified and integrated into

communication networks. It is imperative for things to have the capability of communication – exchanging

data over a network between them and/or with the cloud backend services. Additionally, things may have

other optional features, such as sensing and capturing data, actuating, storing and processing data,

executing native or cloud-based applications, machine learning, etc

. The set of ‘things’ that compose an

IoT ecosystem can be managed by intelligent systems, which are able to autonomously connect to things for

monitoring and controlling them. Moreover, these intelligent systems can retrieve data from a thing or a set

of things and process that data, obtaining useful information in order to make an intelligent decision

2.1.2 Intelligent decision making

The number of devices connected to ‘intelligent systems’ that can store, process, analyse and share data is

sharply increasing. This will result in billions of ‘things’ and machines connected to networks and producing

even more data

. Hence, there is a need to deploy data analytics and smart data management techniques

in order to draw meaningful insight from the colossal volume of data being generated

. Moreover, IoT

encompasses the notion of actuating, for which decision making is necessary.

Intelligent decision-making depends first and foremost on the information available to make the decisions.

These decisions can be as simple as a threshold-crossing mechanism, or as advanced as machine learning or

deep learning systems

. The output of these decisions will eventually lead to actions and may feed new

information into the ecosystem. The information used to make intelligent decisions can be either analysed

locally, since some ‘things’ can process the data they gather themselves, or delegated to another element

of the IoT ecosystem, such as the cloud backend service, the aggregator/gateway, another ‘thing’, etc.

This whole process supports several aspects, such as context awareness and adaptation, autonomy, and

self-optimisation/configuration/healing/protection, to name a few.

2.1.3 Sensors and actuators

Sensors are one of the key building blocks of IoT, since they are an integral element that allows to monitor

the environment and the context on which IoT systems operate. They can be as small as millimetres in size,

making them easy to embed in physical objects – from roadways to pacemakers

On the physical level, sensors can measure defined physical, chemical or biological indicators, and on the

digital level, they collect information about the network and applications. They then generate associated

quantitative data, which can be processed in real-time, or stored for later retrieval, and that can be received

ITU-T Y.2060, «Overview of the Internet of things». See https://www.itu.int/rec/T-REC-Y.2060-201206-I

European Commission, «Definition of a Research and Innovation Policy Leveraging Cloud Computing and IoT Combination». See

https://ec.europa.eu/digital-single-market/en/news/definition-research-and-innovation-policy-leveraging-cloud-computing-and-iot-combination

See http://www.gartner.com/newsroom/id/3598917

See https://www.forbes.com/sites/mikekavis/2014/09/04/making-sense-of-iot-data-with-machine-learning-technologies/

McKinsey&Company, «The Internet of Things». See http://www.mckinsey.com/industries/high-tech/our-insights/the-internet-of-things

Baseline Security Recommendations for IoT

in the context of Critical Information Infrastructures

November 2017

hundreds of kilometres away

. Some examples of sensors are accelerometers, temperature sensors,

pressure sensors, light sensors and acoustic sensors, among others.

Even if they are left unattended in some cases (e.g. roadways), sensors have become essential in a large

number of industries, gathering data for the network and applications to dynamically adapt to optimal

processes at any moment

An actuator can be considered as the entity responsible for moving or controlling a system or mechanism.

In simple terms, an actuator operates in the reverse direction of a sensor. It takes an electrical input and

turns it into physical action. Taking the example of smart lamps and smart thermostats, their actuators can

make use of the signal coming from a light sensor to regulate brightness, and of the signal coming from a

temperature sensor to regulate temperature, respectively. Actuators are also commonly used in

manufacturing and assembly processes, where motors and solenoids are the primary examples of actuators

– for example, valves are a type of actuator, used to control a hydraulic system

To summarise, the functions of input devices are performed by sensors that gather information about their

environment and its context, which will be subsequently processed. In contrast, actuators serve as output

units – they act based on the processed information, executing decisions. It should be noted that, in most

IoT deployments, sensors and actuators are not only found standalone, but also integrated into embedded

systems.

2.1.4 Embedded systems

Sensors and actuators are the fundamental elements of IoT. They may be connected to the cloud backend

through gateways to have the data coming from the sensors processed, in order to make a decision. Instead

of only having sensor and/or actuator networks, IoT devices can also be found as embedded systems, which

include embedded sensors and/or actuators, as well as network capabilities to connect directly to a LAN or

to the cloud, a memory footprint and the ability to run software. Additionally, IoT embedded systems are

based on a processing unit that enables them to process data on their own. Some examples of devices that

contain embedded systems comprise medical implants, wearables such as smart watches, connected lights,

smart thermostats, etc. Figure 3 illustrates the structure of an embedded IoT system.

IEEE, «Towards a definition of the Internet of Things (IoT)». See

http://iot.ieee.org/images/files/pdf/IEEE_IoT_Towards_Definition_Internet_of_Things_Revision1_27MAY15.pdf

Ammar Rayes, Samer Salam, «The Things in IoT: Sensors and Actuators». See https://link.springer.com/chapter/10.1007/978-3-319-44860-2_3

剩余102页未读，继续阅读

powermdp

粉丝: 2
资源: 6

ENISA物联网安全基线：关键信息基础设施指南

物联网安全指南：GSM CLP.11- V2.0详解与关键保护措施

物联网：欧洲行动计划与展望

物联网新时代：智能互联与基础设施融合

LoRa开发_源代码.rar_SX1276驱动_internet of things_lora源码_源代码_物联网

物联网存在网络隐私与安全风险

物联网存在网络隐私与安全风险.pdf

加强关键信息基础设施网络安全保障刻不容缓.pdf

物联网指南-GSMA.pdf

欧洲物联网研究战略路线图：决定未来的关键指南

NIS指令下的网络安全：欧洲关键基础设施的安全边界与实践挑战

最新资源