Skip to main content
Version: 4.0

2.4.7 Device Interfaces

This section’s intended audience is for those personnel who are responsible for device security. Guidance is available from the IoTSF Best Practice Guidelines (IOTSF.VDISC-BPG) regarding Credential Management (part F) and Network Connections (part H).

Req NoRequirementPrimary KeywordSecondary KeywordCompliance Class And Applicability
2.4.7.1The product prevents unauthorised connections to it or other devices the product is connected to.SystemSoftwareMandatory for Class 1 and above
2.4.7.2The network component and firewall (if applicable) configuration has been reviewed and documented for the required/defined secure behaviour.BusinessProcessMandatory for Class 1 and above
2.4.7.3To prevent bridging of security domains within products with network interfaces, forwarding functions should be blocked by default.SystemSoftwareMandatory for Class 1 and above
2.4.7.4Devices support only the versions of application layer protocols that have been reviewed and evaluated against publicly known vulnerabilities.BusinessProcessMandatory for Class 1 and above
2.4.7.5If a potential unauthorised change is detected (e.g.: an access fails authentication or integrity checks), the device should alert the user/administrator to the issue and should not connect to wider networks than those necessary to perform the alerting function. Failed attempts should be logged, but without providing any information about the failure to the initiator.SystemSoftwareMandatory for Class 1 and above
2.4.7.6All the product's unused ports (or interfaces) are closed and only the necessary ones are active.BusinessProcessMandatory for Class 1 and above
2.4.7.7If a connection requires a password or passcode or passkey for connection authentication, the factory issued or reset password is unique to each device.BusinessProcessMandatory for all classes
2.4.7.8Where using initial pairing process, a Strong Authentication shall be used, requiring physical interaction with the device or possession of a shared secret.SystemSoftwareMandatory for Class 1 and above
2.4.7.9Where a wireless interface has an initial pairing process, the passkeys are changed from the factory issued, or reset password prior to providing normal service.BusinessPolicyMandatory for all classes
2.4.7.10For any Wi-Fi connection, WPA-2 AES [IEEE.802.11]1 or a similar strength encryption has been used. Migration to the latest standard should be planned.(e.g. WPA3). Older insecure protocols such as WEP, WPA/WPA2 (Auto), WPA-TKIP and WPA-2 TKIP/AES (Mixed Mode) are disabled.SystemSoftwareMandatory for Class 1 and above
2.4.7.11Where WPA-2 WPS is used it has a unique, random key per device and enforces exponentially increasing retry attempt delays.SystemSoftwareMandatory for Class 1 and above
2.4.7.12All network communications keys are stored securely, in accordance with industry standards.SystemSoftwareMandatory for Class 1 and above
2.4.7.13Where a TCP protocol, such as MQTT, is used, it is protected by a TLS connection with no known vulnerabilities.SystemSoftwareMandatory for Class 1 and above
2.4.7.14Where a UDP protocol is used, such as CoAP, it is protected by a DTLS connection with no known vulnerabilities.SystemSoftwareMandatory for Class 1 and above
2.4.7.15Where cryptographic suites are used such as TLS, all cipher suites shall be listed and validated against the current security recommendations such as NIST 800-131A [NIST.SP.800-131A]2 or OWASP. Where insecure ciphers suites are identified they shall be removed from the product.BusinessProcessMandatory for Class 1 and above
2.4.7.16All use of cryptography by the product, such as TLS cipher suites, shall be listed and validated against the import/export requirements for the territories where the product is to be sold and/or shipped.BusinessProcessMandatory for Class 1 and above
2.4.7.17Where there is a loss of communications or availability it shall not compromise the local integrity of the device.SystemSoftwareMandatory for Class 1 and above
2.4.7.18The product only initialises and enables the communications interfaces, network protocols, application protocols and network services necessary for the product’s operation.SystemSoftwareMandatory for Class 1 and above
2.4.7.19Communications protocols should be latest versions with no publicly known vulnerabilities and/or appropriate for the product.BusinessPolicyMandatory for Class 1 and above
2.4.7.20Post product launch, communications protocols should be reviewed throughout the product life cycle against publicly known vulnerabilities and changed to the most secure versions available if appropriate.BusinessPolicyMandatory for Class 1 and above
2.4.7.21If a factory reset is made, the device should warn that secure operation may be compromised until updated.SystemSoftwareMandatory for Class 1 and above
2.4.7.22Where RF communications are enabled (e.g., ZigBee, etc.) antenna power is configured to limit ability of mapping assets to limit attacks such as WAR-Driving.SystemSoftwareAdvisory for all classes
2.4.7.23Protocol anonymity features are enabled in protocols (e.g., Bluetooth) to limit location tracking capabilities.SystemSoftwareAdvisory for all classes
2.4.7.24As far as reasonably possible, devices should remain operating and locally functional in the case of a loss of network connection.SystemSoftwareMandatory for Class 1 and above
2.4.7.25Following restoration of power or network connection, devices should be able to return to a network in a sensible state and in an orderly fashion, rather than in a massive scale reconnect, which collectively could overwhelm a network.SystemSoftwareMandatory for Class 1 and above

Footnotes​

  1. IEEE 802.11i-2004 "IEEE Standard for information technology-Telecommunications and information exchange between systems-Local and metropolitan area networks-Specific requirements-Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY)". ↩

  2. NIST Special Publication 800-131A Revision 1, "Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths", November 2015. https://csrc.nist.gov/pubs/sp/800/131/a/r2/final. ↩