Cybersecurity Implementation and Certification in Practice for IoT Equipment

Leading Brand in Cybersecurity Compliance Solutions
www.onwardsecurity.com
Cybersecurity
Implementation and
Certification in Practice for
IoT Equipment
Onward Security

1© 2020 Onward Security Corp. All rights reserved.
Notice01
FAQ02
Use Case03
Conclusion and Suggestion04
Q&A05
CONTENTS

© 2020 Onward Security Corp. All rights reserved. 2
01.
Notice
for IoT security standard adoption and certification

5 notices
Explicitly define the classification of IoT
security standardsN1
Determine the standard(s) you needN2
What do you need to invest in or prepare
for?N3
Cooperation items for adoption or
certificationN4
The benefits of obtaining the trademark /
certificateN5

N1. Explicitly define the classifications of IoT
security standards
• Laws and regulations
• U.S. ：FIPS-140-3, …
• U.K. ：CPA, …
• Brand compliance
• Amazon、Apple、Google, …
• AT&T, Nokia, Siemens, …
• Industry requirements
• ICT products: ISO/IEC 15408, …
• IoT devices：CTIA, …
• IIoT：IEC 62443, …
Explicitly define the classifications of
IoT security standardsN1
What do you need to invest in or
prepare for?N3
certificationN4
The benefits of obtaining the
trademark / certificateN5
A growing number
of third-party NPOs
are releasing
standards /
certifications /
trademarks
programs

N2. Determine the standard(s) you need
• Do the customers have any
requirements?
• Regulatory requirements: Governments
• Purchasers: Enterprises & consumers
• Bosses： Department managers, senior
managers
• Where are your products sold? To
whom?
• Countries, regions, industries
• Governments, brands, bids
As long as the
customers are
willing to
accept
prepare for?N3
certificationN4

N3. What do you need to invest in or prepare
for?
• Confirm the scope of adoption or
requirement
• Management processes, design and
development processes, products
• Confirm the accountability units
• Estimate the schedule and cost
• Interdepartmental cooperation
• Do you need the assistance of a
consulting firm?
• Look for the accredited
organization/LAB
The integration
of internal
specialists and
external
resources
prepare for?N3
certificationN4

N4. Cooperation items for adoption or
certification
• The accountability managers or units
• The approaches for interdepartmental
communication and operation
• The adopting information related to
certification
• Departments, fields, systems, products,
devices
• The cooperation with software
technology team
Control your
schedule
effectively and
reserve more
time for
improvement
prepare for?N3
certificationN4

N5.The benefits of obtaining the trademark /
certificate
• Conform to customer requirements
• Guarantee the quality and security
of products
• Obtain the competitive advantages
of business and marketing
promotion
Any other
benefits?
prepare for?N3
certificationN4

02.
FAQ
of IoT security standard adoption and certification

5 FAQs / 5 Suggestions
Q1
Q2
Q3
S1
S2
S3
Why adopt IoT security standard?
How does it help?
Achieve security management
consensus, training
Q4
Q5
How to increase the success rate?
Senior representatives,
accountability specialists, and
cooperation mechanisms
Interdepartmental cooperation
issues?
Accountability units, automated
systems or products assistance
S4
S5
O2O courses, external
consultants, products
Choose a qualified excellent
provider
Lack of professional human
resources?
If any guarantees for obtaining
the certificates?

03.1.
Use case of IoT devices

Use case of IoT devices
Secure smart
home IoT
devices
Equipped
wireless network
function
Intended to enter
the U.S. market
The customer
didn’t know what
to do
Limited time and
budget
Must have the
certificate or the
trademark

Three levels of certification
Level 1
Core security
Level 2
Enhanced security
Level 3
Advanced security
GPS dog collars
Washing machines
GPS trackers
Smart home security systems
Mobile payment
devices
Connected
streetlights
Traffic controllers
Blood glucose
meters
Gas meters
* Reference from CTIA certification

Submit paperwork
Least 3 samples to CATL
Eliminate inconsistencies or resend
samples
Receive the notification Device has been certified
Samples are
consistent with the
application
No
PASS
Receive the samples
Receive and test
Pass / Fail
Upload test report
Document and
payment
checking
Resubmit the samples
Fail
All completed
Incomplete
IoT OEM CTIA
Submission process

03.2.
Use case
of IIoT development process

USe case of IIoT development process
Self-developed
industrial control
products
Equipped
networking
function
Intended to
export to Europe
and the U.S.
Had a certain
amount of
shipment
Limited time and
budget
Must have the
certificate or the
trademark

IEC 62443 standards
IEC 62443-1-1
Terms / concept /
model
IEC 62443-1-2
Terms /
abbreviations /
glossary
IEC 62443-1-3
System security
compliance
standards
IEC 62443-1-4
IACS security
lifecycle and
adoption cases
IEC 62443-2-1
Security plans and
requirements of
IACS asset owner
IEC 62443-2-2
IACS protection
grading
IEC 62443-2-3
The IACS environment
patches / vulnerabilities
management
IEC 62443-2-4
Security plans and
requirements
of IACS service
provider
IEC 62443-2-5
System security
management
implementation guide
for IACS asset owner
IEC 62443-3-1
IACS security
technologies
IEC 62443-3-2
Security risk
assessment
and system design
IEC 62443-3-3
System security
requirements
and grading
IEC 62443-4-1
Secure product
development lifecycle
requirements
IEC 62443-4-2
IACS components
technical security
requirements

Maturity Level Category
ML 1 Initial
ML 2 Managed
ML 3
Defined
(Practiced)
ML 4 Improved
Participants & maturity levels
Participant Work Content
CIIP/ IIOT Owner
Determine the maturity level
for the equipment provider
SI
Determine the maturity level
for the developer
Vendor
Comply with the required
maturity level

Pre-SDL
Training
Phase 1
Requirement
Phase 2
Design
Phase 3
Implementation
Phase 4
Verification
Phase 5
Release
Post-SDL
Requirement
response
Security policy delivery or
training
Security standard &
industrial
requirement
Risk and impact analysis
Security implementation
Security testing and
analysis
Security maintenance
Incident
response
Source: http://hwang.cisdept.cpp.edu/swanew/SDLC.aspx?m=SDLC-Microsoft-SDL
Security management (SM)
Secure development lifecycle

IEC 62443 certification process
Manufacturer Consulting company CBTL/NCB
Determine the scope
and certification level
Perform consulting and
testing service
Submit the application
Perform assessment of
certification
Certification acquired

Conclusion and suggestion
04.

Conclusion and suggestion
Why do IoT devices need security
standard adoption and certification?
Conform to
customer’s
requirements
Sales
Enhance product
competitiveness
Sales/PM/RD
Build a good
corporate image
Marketing
Increase
enterprise sales
revenue
Convert security
costs into benefits

If you still have confusions or questions about
the security standard adoption and certification

Q & A
05

Leading Brand in Cybersecurity Compliance Solutions
THANK Y U

Cybersecurity Implementation and Certification in Practice for IoT Equipment

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Ähnlich wie Cybersecurity Implementation and Certification in Practice for IoT Equipment

Ähnlich wie Cybersecurity Implementation and Certification in Practice for IoT Equipment (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Cybersecurity Implementation and Certification in Practice for IoT Equipment

Hinweis der Redaktion