NIST outlines IoT cybersecurity and privacy risk mitigation
A new report aims to help organizations manage the cybersecurity and privacy risks associated with the increasing number of internet-of-things devices.
To help government agencies, manufacturers and integrators manage the cybersecurity and privacy risks associated with the increasing number of internet-of-things devices, the National Institute of Standards and Technology has issued an internal report, Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks.
The variety and number of single-purpose IoT devices requires organizations to evaluate their current cybersecurity and privacy practices and make necessary changes, NIST says.
Unlike conventional IT equipment, IoT devices interact with the physical environment, including non-IoT devices, cloud-based services, people and other components. They cannot be accessed and monitored like typical IT equipment because they frequently lack management features, and user interfaces. Plus, they can be difficult to manage at scale because of their varying lifespans, the different software employed, and the challenges with maintaining an accurate inventory.
Additionally, IoT devices have different cybersecurity and privacy capabilities than traditional IT, the report says. They often cannot support the security features built into IT components, like system logs, strong encryption or authentication or central management, making them difficult to protect.
NIST lays out three high-level goals -- protecting devices, data and individuals' privacy throughout the device lifecycle -- and outlines the potential challenges agencies may face along with mitigation strategies.
A detailed chart describes expected IoT capabilities, the challenges, the affected NIST SP 800-53 controls, implications for the organization and affected subcategories of the Cybersecurity Framework. So an IoT device that does not conceal the display of password characters, for example, affects authenticator feedback controls (IA-6) and increases the risk of credential theft.
NIST recommends agencies thoroughly understand the challenges IoT devices pose to cybersecurity and privacy. They should also adjust their policies and processes to take into account issues of scaling, privacy risk management and supply-chain security. Organizations should also "consider the tradeoffs among these risks when making decisions about cybersecurity and privacy risk mitigation," NIST says. "Managing cybersecurity and privacy risks for some IoT devices may affect other types of risks and introduce new risks to safety, reliability, resiliency, performance, and other areas."
NEXT STORY: NIST issues new cyber guidelines for contractors