IoT Security Baselines: NIST, ETSI EN 303 645, and OWASP

Why IoT security baselines matter

Connected devices are now common in homes and offices. But most deployments treat security as an afterthought: default credentials left unchanged, no update mechanism, devices on the same network as sensitive data.

NIST IoT Cybersecurity (NISTIR 8259)

• Device identification — unique, non-guessable identifiers per device
• Device configuration — ability to change configuration securely
• Data protection — encryption at rest and in transit
• Logical access — authentication and authorisation controls
• Software updates — authenticated, integrity-checked update mechanism
• Cybersecurity event awareness — logging for security-relevant events

ETSI EN 303 645

• No universal default passwords
• Secure update mechanism
• Communications security — TLS required
• Minimal attack surface
• Personal data protection

OWASP IoT Top 10

1. Weak, guessable, or hardcoded passwords
2. Insecure network services
3. Insecure ecosystem interfaces
4. Lack of secure update mechanisms
5. Use of insecure or outdated components
6. Insufficient privacy protection
7. Insecure data transfer and storage
8. Lack of device management
9. Insecure default settings
10. Lack of physical hardening

In practice

• Change all default credentials before deployment
• Put IoT devices on a dedicated VLAN
• Use TLS for all device-to-cloud communication