What is AWS IoT Device Defender
AWS IoT Device Defender is a fully managed service that helps you secure your fleet of IoT devices. AWS IoT Device Defender continuously audits your IoT configurations to make sure that they aren’t deviating from security best practices. A configuration is a set of technical controls you set to help keep information secure when devices are communicating with each other and the cloud. AWS IoT Device Defender makes it easy to maintain and enforce IoT configurations, such as ensuring device identity, authenticating and authorizing devices, and encrypting device data. AWS IoT Device Defender continuously audits the IoT configurations on your devices against a set of predefined security best practices. AWS IoT Device Defender sends an alert if there are any gaps in your IoT configuration that might create a security risk, such as identity certificates being shared across multiple devices or a device with a revoked identity certificate trying to connect to AWS IoT Core.
AWS IoT Device Defender also lets you continuously monitor security metrics from devices and AWS IoT Core for deviations from the expected behaviors for each device. You can define the appropriate behavior for your devices or use machine learning to model the regular device behavior based on historical data. If something doesn’t look right according to defined behaviors or ML models, AWS IoT Device Defender pushes an alarm so you can take action to mitigate the issue. For example, traffic spikes in outbound traffic might indicate that a device is participating in a DDoS attack. AWS IoT Greengrass and FreeRTOS automatically integrate with AWS IoT Device Defender to provide security metrics from the devices for evaluation.
AWS IoT Device Defender can send alarms to the AWS IoT Console, Amazon CloudWatch, and Amazon SNS. If you determine that you need to take an action based on an alarm, you can use AWS IoT Device Defender built-in mitigation actions such as adding a thing to a thing group (for example, quarantine) or AWS IoT Device Management to take additional mitigation steps such as pushing security fixes.
Why is IoT security important
Connected devices are constantly communicating with each other and the cloud using different kinds of wireless communication protocols. While communication creates responsive IoT applications, it can also expose IoT security vulnerabilities and open up channels to malicious actors or accidental data leaks. To protect users, devices, and companies, IoT devices must be secured and protected. The foundation of IoT security exists within the control, management, and set up of connections between devices. Proper protection helps keep data private, restricts access to devices and cloud resources, offers secure ways to connect to the cloud, and audits device usage. An IoT security strategy reduces vulnerabilities using policies like device identity management, encryption, and access control.
What are the challenges with IoT security
A security vulnerability is a weakness which can be exploited to compromise the integrity or availability of your IoT application. IoT devices by nature, are vulnerable. IoT fleets consist of devices that have diverse capabilities, are long-lived, and are geographically distributed. These characteristics, coupled with the growing number of devices, raise questions about how to address security risks posed by IoT devices. To further amplify security risks, many devices have a low-level of compute, memory, and storage capabilities, which limits opportunities for implementing security on devices. Even if you have implemented best practices for security, new attack vectors are constantly emerging. To detect and mitigate vulnerabilities, organizations should consistently audit device settings and health.
AWS IoT Device Defender helps you manage IoT security
Audit device configurations for security vulnerabilities
Continuously monitor device behavior to identify anomalies
Receive alerts and take action
When to use AWS IoT Device Defender for IoT security
When you connect your devices to AWS IoT Core, it provides the security building blocks for you to securely connect devices to the cloud and to other devices. The building blocks allow enforcing security controls such as authentication, authorization, audit logging and end-to-end encryption. However, human or systemic errors and authorized actors with bad intentions can introduce configurations with negative security impacts.
Continuous compliance and adoption of security best practices
Attack surface evaluation
Threat impact analysis
“AWS IoT Device Defender provides device behavior monitoring that is a must-have for any IoT company that is building a secure infrastructure.”
- Franz Garsombke, CTO, Rachio
"SolarNow’s business reputation and revenue model is built on zero-tolerance of any controllable service disruption. AWS IoT Device Defender and Eseye global AnyNet Secure connectivity is the easiest, quickest, and most cost-effective way for us to achieve and scale a high level of device security and anomaly detection. This protects our customers from service interruptions and SolarNow’s reputation for excellent customer service.”
- Peter Huisman, CTO, SolarNow
Blog posts & webinars
At AWS, security is a top priority. Join us to discuss how to use AWS IoT services, such as AWS IoT Core, AWS IoT Device Management, and AWS IoT Device Defender, to improve the security of IoT applications. We discuss IoT security best practices and cover how to manage security across IoT fleets, including monitoring and auditing of devices. Hear from AWS IoT experts, AWS customer Rachio, and AWS partner Eseye on their experience in securing devices.