AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices. This tech talk will introduce the best practices for IoT Security in the cloud and the access control mechanisms used by AWS IoT. These mechanisms can be used to not only securely build and provision devices, but also to integrate devices with other AWS services to create secure solutions. Learning Objectives: • Learn common Internet of Things security issues • Learn about AWS IoT security and access control mechanisms • Learn how to build secure interactions with the AWS Cloud

1. © 20167 Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Andrew Kiggins
Feb 2017
AWS IoT
Security

2. Today’s Webinar
IoT overview
The risks
Protecting communications
Protecting the devices

3. All things around us are getting connected

4. AWS IoT
DEVICE SDK
Set of client libraries to
connect, authenticate and
exchange messages
DEVICE GATEWAY
Communicate with devices via
MQTT and HTTP
AUTHENTICATION
AUTHORIZATION
Secure with mutual
authentication and encryption
RULES ENGINE
Transform messages
based on rules and
route to AWS Services
AWS Services
- - - - -
3P Services
DEVICE SHADOW
Persistent thing state
during intermittent
connections
APPLICATIONS
AWS IoT API
DEVICE REGISTRY
Identity and Management of
your things

5. Security and Identity
AUTHENTICATION
Secure with mutual
authentication and encryption

6. AWS Foundation Services
Compute Storage Database Networking
AWS Global
Infrastructure
Regions
Availability Zones
Edge Locations
Client-side Data
Encryption
Server-side Data
Encryption
Network Traffic
Protection
Platform, Applications, Identity & Access Management
Operating System, Network & Firewall Configuration
Customer applications & content
Customers
Security shared responsibility
Customers are
responsible for
their security IN
the Cloud
AWS is
responsible for
the security OF
the Cloud

7. The Risk
I’m a thing
pwn’d

8. Protocol Support

9. AWS IoT Protocols
MQTT over
TLS
MQTT over
Web Sockets
HTTPS
Server Auth Cert Cert Cert
Client Auth Cert AWS API Keys AWS API Keys
Cert
Confidentiality TLS TLS TLS
Protocol MQTT Web Sockets
MQTT
HTTP/MQTT

10. AWS IoT Identities

11. Credentials Overview

12. Security and Identity
Identity Principles Usage
X.509 certificates Device identity
IAM users, groups and roles Application layer access for
HTTP or Websockets
Amazon Cognito Identities API Access

13. Authentication

14. Security and Identity

15. Certificate management
Certificate creation
mechanism
Pros Cons
AWS IoT created certificate
(including public/private
keypair)
Everything handled by AWS
IoT
Private key has to be
transmitted between AWS
IoT and customer
AWS IoT created certificate
(Certificate Signing
Request(CSR) based)
Certificate creation handled
by AWS. AWS never has the
private key.
Customer has to create the
public/private keypair and
CSR.
JiTR/BYOC (Bring Your Own
Certificate)
AWS never has the private
key. Customer controls
certificate creation
Customer has to create a
certificate for every device.

16. When is a certificate not a valid certificate
t1
t2
• t1 is earlier than t2, (i.e. the server cert is in the future)
• No realtime clock
• No NTP update (chicken and egg)
• Don’t valid the timestamp if you’ve never connected to the NTP Server
• Don’t validate the timestamp if the device has been on the shelf for a long time

17. Authorization

18. Fine grained policies
• Effect
• Action
• Principal
• Substitution
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"iot:Publish"
],
"Resource":[
"arn:aws:iot:us-east-
1:123456789012:topic/${iot:Connection.Thing.
ThingTypeName}/${iot:Connection.Thing.ThingN
ame}"
]
}
]
}

19. Policy and certificates
Device Policy
Truck 1 Allow to connect and publish
Truck 2 Allow to connect / publish /
subscribe
Truck 3 Allow to connect / publish
/subscribe / unsubscribe

20. Policy actions
• Connect
• Publish
• Subscribe
• Unsubscribe
• Receive

21. Encryption

22. History of TLS/SSL
Evolution of Web Encryption Technologies
1995
SSL2.0
1996
SSL3.0
2006
TLS1.1
2008
TLS1.2
2014/09
POODLE
2011
BEAST
2014/04
Heartbleed
2016/03
DROWN
Battle Against Vulnerabilities
1999
TLS1.0
2015
FREAK
2013
Planning of
TLS1.3 starts

23. Greater Enforcement by Industry/Vendors
Battle Against Vulnerabilities
2014/09
POODLE
2011
BEAST
2014/04
Heartbleed
2016/03
DROWN
Industry Enforcement
2015
FREAK
2015/12
Indexing
HTTPS Pages
by Default
2016/04
PCI DSS v3.2
2016/07
Mandatory
ATS
2016/08
HTTP Strict
Transport
Security (HSTS)
2017/06/30
Mandatory
TLS1.2

24. TLS1.2 in AWS IoT
• Client side certs should be at least
• 2048 for RSA
• P-256 and P-384 curves for ECC
• Recommended cipher suites
• ECDHE-ECDSA-AES128-GCM-SHA256
• ECDHE-RSA-AES128-GCM-SHA256
• 2048-bit primes for DH

25. Securing your thing

26. Certificates & keys
• Securing private keys
• Hardware based solutions
• Securing certificates
• Manufacturing
• Install on boot

27. Identifying misbehavior
• Pen-testing
• Open ports
• Manufacturing
• In-service
• On Thing agent
• Vulnerability scanning
• CIS
• CVE
• Telemetry

28. Thanks !
https://docs.aws.amazon.com/iot/latest/developerguide/iot-
security-identity.html