Industry Standards

Introduction

Standardization of best practices has proliferated on account of both the complexities involved in managing the security of edge devices as well as the high-value nature of many of the assets which act as extensions to edge solutions. This effort involves both public and private bodies and currently is largely voluntary. However, without sufficient industry-led management of edge security, regulation of the technology will likely become onerous.

While the literature on edge-related standards is complex and frequently industry-specific, there are many commonalities between the different recommendations. A unified network security management approach is well equipped to satisfy the assortment of best practices.

This document is intended to provide some useful pointers into the vast body of standards. It is, however, non-exhaustive.

CTIA

• Cybersecurity Certification Test Plan for IoT Devices
  • Test plan for IoT device security readiness, developed by the trade association CTIA (formerly known as “Cellular Telecommunications and Internet Association”)

NIST (National Institute of Standards and Technology)

• CSF (Cyber Security Framework)
  • Security guidance on preventing, detecting, and responding to cyber attacks
• NISTIR - 8228
  • Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks
• NIST SP 800-53
  • Security and Privacy Controls for Federal Information Systems and Organizations
• NIST SP 800-63B
  • Digital Identity Guidelines: Authentication and Lifecycle Management
• NIST 800-113
  • Guide to SSL VPNs

NERC/FERC (North American Electric Reliability Corporation and Federal Energy Regulatory Commission)

These public (FERC) and private (NERC) entities provide standards/regulations for the energy industry. The guidelines are also useful in other critical infrastructure industries.

• CIP-003-7 – Cyber Security – Security Management Controls
• CIP-005-5 – Cyber Security – Electronic Security Perimeter(s)
• CIP-007-5 – Cyber Security – Systems Security Management