This session will introduce best practices for IoT security in the cloud and the access control mechanisms used by AWS IoT. These mechanisms can be used to not only securely build and provision devices, but also to integrate devices with other AWS services. As a result, you are able to scale and innovate, while maintaining a secure environment.

1. © 20167 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Gavin Adams
March,2017
Best Practices with AWS IoT
Security

2. We’ll Cover Best Practices Related to...
Overall AWS IoT
Understanding risks
Protecting communications
Protecting the devices

3. All things around us are getting connected

4. AWS IoT
DEVICE SDK
Set of client libraries to
connect, authenticate and
exchange messages
DEVICE GATEWAY
Communicate with devices via
MQTT and HTTP
AUTHENTICATION
AUTHORIZATION
Secure with mutual
authentication and encryption
RULES ENGINE
Transform messages
based on rules and
route to AWS Services
AWS Services
- - - - -
3P Services
DEVICE SHADOW
Persistent thing state
during intermittent
connections
APPLICATIONS
AWS IoT API
DEVICE REGISTRY
Identity and Management of
your things

5. Security and Identity
AUTHENTICATION
Secure with mutual
authentication and encryption

6. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure
Regions
Availability Zones
Edge Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer applications & content
Customers
Security shared responsibility
Customers are
responsible for
their security IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

7. Why focus on “things”?

8. The Risk
I’m a thing
pwn’d

12. Protecting Things

13. Protocol Support

14. AWS IoT Protocols
MQTT over
TLS
MQTT over
Web Sockets
HTTPS
Server Auth Cert Cert Cert
Client Auth Cert AWS API Keys AWS API Keys
Cert
Confidentiality TLS TLS TLS
Protocol MQTT Web Sockets
MQTT
HTTP/MQTT

15. AWS IoT Identities

16. Credentials Overview

17. Security and Identity
Identity Principles Usage
X.509 certificates Device identity
IAM users, groups and roles Application layer access for
HTTP or Websockets
Amazon Cognito Identities API Access

18. Authentication

19. Security and Identity

20. Certificate management
Certificate creation
mechanism
Pros Cons
AWS IoT created certificate
(including public/private
keypair)
Everything handled by AWS
IoT
Private key has to be
transmitted between AWS
IoT and customer
AWS IoT created certificate
(Certificate Signing
Request(CSR) based)
Certificate creation handled
by AWS. AWS never has the
private key.
Customer has to create the
public/private keypair and
CSR.
JiTR/BYOC (Bring Your Own
Certificate)
AWS never has the private
key. Customer controls
certificate creation
Customer has to create a
certificate for every device.

21. When is a certificate not a valid certificate
t1
t2
• t1 is earlier than t2, (i.e. the server cert is in the future)
• No realtime clock
• No NTP update (chicken and egg)
• Don’t valid the timestamp if you’ve never connected to the NTP Server
• Don’t validate the timestamp if the device has been on the shelf for a long time

22. Authorization

23. Fine grained policies
• Effect
• Action
• Principal
• Substitution
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"iot:Publish"
],
"Resource":[
"arn:aws:iot:us-east-
1:123456789012:topic/${iot:Connection.Thing.
ThingTypeName}/${iot:Connection.Thing.ThingN
ame}"
]
}
]
}

24. Policy and certificates
Device Policy
Truck 1 Allow to connect and publish
Truck 2 Allow to connect / publish /
subscribe
Truck 3 Allow to connect / publish
/subscribe / unsubscribe

25. Policy actions
• Connect
• Publish
• Subscribe
• Unsubscribe
• Receive

26. Encryption

27. History of TLS/SSL
Evolution of Web Encryption Technologies
1995
SSL2.0
1996
SSL3.0
2006
TLS1.1
2008
TLS1.2
2014/09
POODLE
2011
BEAST
2014/04
Heartbleed
2016/03
DROWN
Battle Against Vulnerabilities
1999
TLS1.0
2015
FREAK
2013
Planning of
TLS1.3 starts

28. Greater Enforcement by Industry/Vendors
Battle Against Vulnerabilities
2014/09
POODLE
2011
BEAST
2014/04
Heartbleed
2016/03
DROWN
Industry Enforcement
2015
FREAK
2015/12
Indexing
HTTPS Pages
by Default
2016/04
PCI DSS v3.2
2016/07
Mandatory
ATS
2016/08
HTTP Strict
Transport
Security (HSTS)
2017/06/30
Mandatory
TLS1.2

29. TLS1.2 in AWS IoT
• Client side certs should be at least
• 2048 for RSA
• P-256 and P-384 curves for ECC
• Recommended cipher suites
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-GCM-SHA256
• 2048-bit primes for DH

30. Securing your thing

31. Certificates & keys
• Securing private keys
• Hardware based solutions
• Securing certificates
• Manufacturing
• Install on boot

32. Identifying misbehavior
• Pen-testing
• Open ports
• Manufacturing
• In-service
• On Thing agent
• Vulnerability scanning
• CIS
• CVE
• Telemetry

33. Thanks !
https://docs.aws.amazon.com/iot/latest/developerguide/iot-
security-identity.html