IoT Security Initiative

The IoT Security Initiative provides comprehensive guidance and tools for ensuring that the right levels of security and privacy are instilled into created and deployed products, systems, and services. The IoT Security Initiative provides broad, high-level material - that is at the same time direct, specific and actionable - to practitioners in various roles of solution development, management, IT, and information security. This classification scheme not only provides a helpful, simple nomenclature for quickly understanding the type of device in the system, but will also allow for further stratification in the mapping of threat, risk, and recommended security controls based on operational considerations. Ultimately, there is the type of asset that makes up a product or service - a standalone system or user - which will have an inventory of attack surface items associated with it given its inherent technologies and operating properties. As the defender, the goal is to consider the possible threats, identify known or potential vulnerabilities, and apply security controls in an adequate manner to protect the system and operations. Understanding the landscape of possible threats end-to-end is a critical step in defending system security and operational integrity of the solutions components. The asset in this sense is the computing system; be that an embedded IoT or M2M device, a wearable, a gateway on a factory floor, or a virtual server - on a physical server - or out in a cloud datacenter. As the perception of threat, and the criticality of a system and its data go up, so too does the need for greater levels of security controls.