Practical Internet of Things Security - Second Edition

Detection and analysis

Today's Security Information and Event Management (SIEM) systems are powerful tools that allow correlation between any type of observable event to flag possible incidents. These same systems can of course be configured to monitor the infrastructure that supports IoT devices; however, there are considerations that will affect the ability to maintain a sufficient degree of situational awareness across a deployed IoT system:

• IoT systems are heavily dependent on cloud-hosted infrastructures or edge gateway systems
• IoT systems may include highly constrained (that is, limited processing, storage, or communication ability) devices that often lack the ability to capture and forward event logs

These considerations drive a ...