Reduce the risk posed by IoT devices

The data processing environment is separated from public data networks and other environments with a lower security level in a sufficiently safe manner.

Separation of data systems is one of the most effective factors in protecting confidential information. The goal of separation is to delimit the processing environment of confidential information into a manageable entity, and in particular to be able to limit the processing of confidential information to sufficiently secure environments only. Separation of environments can be implemented, for example, with the help of a firewall solution.

An appropriate log is generated from the use of the network to enable the detection of actions relevant to cyber security.

The normal state of network traffic (traffic volumes, protocols, and connections) is known. In order to detect anomalies, there is a procedure for detecting events that are different from the normal state of network traffic (for example, anomalous connections or their attempts).

Only acquire IoT devices that have built-in security functions and will receive security updates.

It is also important to make sure that it is possible to change all standard passwords and the IoT devices can be forced to only use networks that the organisation has control over.

Create a plan for deploying IoT devices to include security aspects with risk assesments. This includes, for example, assessment of the cloud the device connects to.

Isolate the IoT devices in separate network zones and consider their location with regard to unauthorised physical access to the devices.