Cyber Defense eMagazine May 2019

“Standards-based cybersecurity risk management will continue to be a major factor in the trustworthiness
of IoT applications and devices.” IoT is unique and will require tailoring existing standards as well as
creating new standards to address the wide array of IoT devices. Without these standards it would be
nearly impossible to harden IoT devices across the board and across various sectors, while maintaining
their functionality (NIST, 2018 Internet). In addition, the report states, “… the adoption of IoT brings
cybersecurity risks that pose a significant threat to the nation.”
In September 2018, NIST release a draft of their internal report (NISTIR) 8222 Internet of Things (IoT)
Trust Concerns. In it, they break down 17 trust concerns that impact the security of IoT devices and
services and is derived from their SP 800-183 (“Networks of Things”). They identify actions for mitigation
and push additional areas for further exploration and study. As of the publication date of this article, the
current draft has been withdrawn from the web, “to synchronize with other pending documents on this
topic, and to ensure time for stakeholders to review and comment.” NIST adds that, “Once the draft
document has been re-posted, the comment period will be extended” (NIST, 2018 Interagency).
To expand upon this, we feel a NIST Risk Management Framework (RMF) approach may be used to
secure IoT devices. The RMF is a common information security framework used by the federal
government to improve information security and risk management processes. Simply stated, the RMF
provides a review of an information system’s security against established baselines. Identified risks are
either fixed, mitigated, or deemed acceptable, in accordance with their usage. Once the system has gone
through the testing phase of the RMF, the security and risk level of the system is vetted to the owner of
the system. The designated “owner” may then accept the risk and grant the system an Authorization to
Operate (ATO) on their network. The six-step process, involves 1) categorization of information systems
based on impact due to loss of Confidentiality, Integrity, and Availability (CIA), 2) selection of security
controls in accordance with a baseline and categorization results, 3) implementation of NIST security
controls, 4) assessment of security controls addressing objectives and methods verifying compliance,
schedule and procedures/validation and assessment with remediation as necessary, 5) authorization of
information systems results in submittal and review of the package to the System Owner (SO) who will
accept any residual risk and 6) monitoring of security controls to detect changes, their impact and
updating of documentation to reflect current status. The cycle is typically three years before
reassessment, unless other continuous monitoring strategies are in place.
93