The NIST National Cybersecurity Center of Excellence (NCCoE) has released the final versions of three publications to help secure Internet of Things (IoT) devices and their networks.  

Together, these publications provide a comprehensive approach to help ensure the secure onboarding of IoT devices to networks, safeguard IoT devices from unauthorized networks, and manage these devices throughout their lifecycles. 

Background 

As with any other device, an IoT device needs appropriate credentials to connect to a network securely. Establishing trust between a network and an IoT device prior to providing the device with credentials it needs to join the network is crucial for mitigating the risk of potential attacks. The NCCoE recommends the use of trusted network-layer onboarding to provide scalable, automated, trusted ways to provide IoT devices with unique network credentials and manage devices throughout their lifecycles to ensure that they remain secure.  

Publications 

1. NIST Cybersecurity White Paper (CSWP) 42, Towards Automating IoT Security: Implementing Trusted Network-Layer Onboarding, provides an overview of trusted IoT device network-layer onboarding to securely provision IoT devices with unique local network credentials. 
2. NIST Internal Report 8350, Foundational Concepts in Trusted IoT Device Network-Layer Onboarding, describes the capabilities, characteristics, and benefits of trusted IoT device network-layer onboarding and explains the important role that onboarding can play in the protection of IoT devices and networks throughout the device lifecycle. 
3. NIST Special Publication (SP) 1800-36, Trusted IoT Device Network-Layer Onboarding and Lifecycle Management: Enhancing Internet Protocol-Based IoT Device and Network Security, provides demonstrations and detailed guidelines on how to implement trusted IoT device network-layer onboarding and manage these devices throughout their lifecycle using standards, best practices, and commercially available technology. 

Our four-year engagement with industry partners yielded several builds and draft releases, demonstrating both the complexity of the challenge and the robustness of the solutions offered in this space. By following these guidelines, IoT device users can protect their networks and devices from potential threats. We thank everyone who reviewed the draft IoT publications and provided insightful comments – your feedback was invaluable in helping us refine and improve the final documents. 

Stay Involved – Join the IoT Community of Interest! 

Want to stay up to date on future NCCoE IoT projects? Join the NCCoE IoT Community of Interest! If you have any questions, please reach out to the project team at iot-onboarding [at] nist.gov (iot-onboarding[at]nist[dot]gov).  

View this on the NCCoE website