Cloud Hosting

The EU Agency for Cybersecurity (ENISA) has released guidance on securing the IoT supply chain. Connected devices have long been recognised as both a boon and a liability: the ENISA guidance is squarely aimed at securing supply chain integrity and mitigating the risks of exposure to third parties with a weak(er) security posture.

What is particularly interesting is the focus on the risks associated with the manufacture of the physical product. Cyber has historically had a fractious relationship with physical risk (is data tangible property? is physical damage from a cyber attack a material consideration?). The ENISA guidance is very clear that IoT devices are subject to a blend of physical threats as well as all the traditional code-based risks. It flags the exposures generated by assembly line sabotage, tamper-proof casing limitations and magnetic attacks. They sit alongside the traditional threats of IP theft, network compromise and patching vulnerabilities.

It's refreshing to see a risk assessment that fuses both the tangible with the intangible. The physical exposure to the digital should properly remain a consideration.

Guidelines for Securing the Internet of Things Download PDF document, 1.74 MB This ENISA study defines guidelines for securing the supply chain for IoT. ENISA with the input of IoT experts created security guidelines for the whole lifespan: from requirements and design, to end use delivery and maintenance, as well as disposal. The study is developed to help IoT manufacturers, developers, integrators and all stakeholders that are involved to the supply chain of IoT to make better security decisions when building, deploying, or assessing IoT technologies.

https://www.enisa.europa.eu/publications/guidelines-for-securing-the-internet-of-things

Original post:
Cyber security and the Internet of Things - Lexology