The Industrial Internet Consortium publishes IoT security maturity model white paper
The Industrial Internet ConsortiumÂ®Â (IICâ„˘), the organisation transforming business and society by accelerating the Industrial Internet of Things (IIoT), announced the publication of theÂ IIC IoTÂ Security Maturity Model:Â Description and Intended UseÂ white paper.
Building on concepts identified in theÂ IIC Industrial Internet Security Framework, the Security Maturity Model (SMM) defines levels of security maturity for a company to achieve based on its security goals and objectives as well as its appetite for risk. This enables decision makers to invest in only those security mechanisms that meet their specific requirements.
â€śThe Internet of Things has brought a lot of innovation to industries, but it also introduces new security threats. The security landscape is complex and always changing,â€ť said Ron Zahavi, IIC Security Applicability group co-chair, the white paper co-author and chief strategist for Azure IoT Standards atÂ Microsoft.
â€śIt can be challenging for organisations to understand where to focus their security budgets, especially with limited resources. The Security Maturity Model provides organisations with an informed understanding of security practices and mechanisms applicable to their industry and scope of their IoT solution.â€ť
â€śOver one-third of operational technology professionals in the enterprise identified security concerns as the largest impediment to production deployments of IoT projects, (Source:Â 451 Research, Voice of the Enterprise: Internet of Things OT 2018),â€ť said Christian Renaud, research director, Internet of Things, 451 Research.
â€śThis is consistent with the feedback we have received from information technology professionals over the last two years, and highlights the criticality of a common, extensible model for IoT security to move the industry forward.â€ť
Organisations apply the SMM by following a process. First, business stakeholders define security goals and objectives, which are tied to risks. Technical teams within the organisation, or third-party assessment vendors, then map these objectives into tangible security techniques and capabilities and identify an appropriate security maturity level.
Following this, organisations develop a security maturity target, which includes industry and system-specific considerations, and capture the current security maturity state of the system.
â€śBy periodically comparing target and current states, organisations can identify where they should make improvements,â€ť said Sandy Carielli, white paper co-author and director of Security Technologies atÂ Entrust Datacard. â€śOrganisations achieve a mature system security state by making continued security assessments and improvements over time. They can repeat the cycle to maintain the appropriate security target as their threat landscape changes.â€ť
TheÂ IIC IoT Security Model: Description and Intended UseÂ white paper is an introduction to the SMM. TheÂ IIC Security Maturity Model: Practitioners GuideÂ willÂ be released in the coming months and will contain the technical guidance for assessment and enhancement of security maturity level for appropriate practices.
The fullÂ IICÂ IoT Security Maturity Model: Description and Intended UseÂ white paper and a list of IIC members who contributed can be found on the IICÂ website.
Comment on this article below or via Twitter @IoTGN