97 Things Every Information Security Professional Should Know

Chapter 50. Security Considerations for IoT Device Management

Mansi Thakar

There are constantly new additions to the environment, whether it’s at your work or home. From Alexas to smart toasters to the remote sensors that track how many people walked through the hallway, these Internet of Things (IoT) devices are being incorporated at an exponentially fast rate. This article aims to expand on security requirements with respect to the IoT device management life cycle.

Approved IoT devices and internal IoT development

Considerations about whether your devices should be manageable from a central platform, whether there is a security review board that looks at the device from both a functionality and an architectural point of view, and how often do you want to review the device can be explored here.

Inventory

There is more than just one type of owner for such devices. For example, there would be someone responsible for the device itself. If it’s an in-house made device, then this person can be the creator of it. There could be a solution owner, someone who is responsible for meeting the business unit’s requirements. Depending on which tool you choose to track, collecting more information than less is helpful.

Here are a few items, not an exhaustive list:

• Manufacturer and model

• Owner(s)

• Installation location and photograph of the device at installation (this can help with future ...