Cloud Security Alliance Debuts Internet of Things (IoT) Controls Framework and Accompanying Guide

The Cloud Security Alliance (CSA) announced the release of the CSA IoT Controls Framework, its first such framework for IoT that introduces the base-level security controls required to mitigate many of the risks associated with an IoT system operating in a range of threat environments.  Created by the CSA IoT Working Group, the new Framework together with its companion piece, the Guide to the CSA Internet of Things (IoT) Controls Framework, provide organizations with the context in which to evaluate and implement an enterprise IoT system that incorporates multiple types of connected devices, cloud services, and networking technologies.

With the implementation of increasingly complex IoT systems—defined by the European Union Agency for Network and Information Security as “cyber-physical ecosystem[s] of interconnected sensors and actuators, which enables intelligent decision making”—organizations need clear guidance to identify appropriate security controls and allocate them to specific components within their system. These components include but are not limited to simple sensors, simple actuators, edge devices, fog computing, mobile device/application, on-premise intermediary device, cloud gateway, and cloud app/service.

Utilizing the Framework, user owners will assign system classification based on the value of the data being stored and processed and the potential impact of various types of physical security threats.  Regardless of the value assigned, the Framework has utility across numerous IoT domains from systems processing only “low-value” data with limited impact potential, to highly sensitive systems that support critical services.

The CSA IoT Working Group develops frameworks, processes and best-known methods for securing these connected systems.  Further, it addresses topics including data privacy, fog computing, smart cities and more. Individuals interested in becoming involved in future IoT research and initiatives are invited to visit the Internet of Things Working Group join page.