NIST Internal Report (IR) 8349, titled “Methodology for Characterizing Network Behavior of Internet of Things Devices,” outlines a comprehensive approach to capturing, documenting, and analyzing the network communication behaviors of IoT devices. The report aims to enable manufacturers, network administrators, and researchers to create Manufacturer Usage Description (MUD) files that specify the necessary network interactions of IoT devices, facilitating improved network access control and device security. It emphasizes the importance of characterizing IoT network behavior to restrict communication to only what is necessary, aiding in the identification of misbehaving devices that may indicate compromise. The methodology covers different types of network traffic captures, such as activity-based and time-based captures, and stresses thorough documentation of environmental variables and device life-cycle phases during data collection. Additionally, the report introduces tools like MUD-PD to assist in automating the characterization process, supporting multiple use cases including manual analysis and MUD file generation. Overall, the report provides vital guidance to bolster cybersecurity for IoT devices by enabling precise control and monitoring of their network communications.
Publication's URL
https://csrc.nist.gov/pubs/ir/8349/finalAdditional documents on this topic
- CIS Controls Internet of Things Companion Guide ★★★★★
- NIST SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security
- CISA Principles for the Secure Integration of Artificial Intelligence in Operational Technology
- NIST SP 800-88 Rev. 2 Guidelines for Media Sanitization
- NIST ZTA Component mapping to NIST CSF and Controls