apply-iot-network-hardening

name	apply-iot-network-hardening
description	Use when designing IoT device network interfaces — disabling unnecessary services, enforcing TLS for all communication, segmenting devices on isolated VLANs, and securing management APIs.
source	OWASP IoT Top 10 I2 I3 (owasp.org/www-project-internet-of-things/); NIST SP 800-82 (Industrial Control Systems Security); ETSI EN 303 645 (IoT Cybersecurity); Shodan IoT security research
tags	["security","owasp","iot","network","tls","vlan","firewall","embedded"]

Apply IoT Network Hardening

Disable unnecessary network services, enforce mutual TLS for device-cloud communication, segment IoT devices on isolated VLANs, and restrict management interfaces to authorized addresses — preventing network-based device compromise.

Why This Is Best Practice

Adopted by: OWASP IoT Top 10 I2 (Insecure Network Services) and I3 (Insecure Ecosystem Interfaces). ETSI EN 303 645 (European IoT cybersecurity standard, 2020) mandates disabling unused services and TLS for all communications. NIST SP 800-82 guides industrial IoT network segmentation. Shodan's 2023 report found 1.5 million IoT devices exposing Telnet (port 23), 500,000 exposing unencrypted MQTT (port 1883), and 2 million exposing unauthenticated HTTP management interfaces. Impact: Mirai botnet (2016) infected 600,000 devices primarily by scanning for open Telnet and using default credentials — the services had no legitimate user need but were enabled by default. The Shodan IoT exposure report estimates 40% of internet-connected IoT devices expose at least one unauthenticated management interface. CISA's 2022 IoT advisory found that network segmentation failures are the primary vector allowing IoT device compromise to pivot to IT networks, causing incidents including the 2021 Oldsmar water treatment plant hack. Why best: Open network services on IoT devices are attack surface that cannot be patched without disabling them — each Telnet port and unauthenticated HTTP endpoint is a permanent vulnerability unless removed from the firmware. Network segmentation limits blast radius: a compromised IoT device on its own VLAN cannot reach internal servers or workstations, containing the incident.

Sources: OWASP IoT Top 10 I2, I3; ETSI EN 303 645 section 4; Shodan State of IoT Security (2023); CISA "Securing the Internet of Things" advisory (2022)

Steps

1. Disable all unnecessary network services in firmware:

   # On embedded Linux (OpenWRT/Yocto) — disable services at build time
   
   # Remove or disable Telnet entirely
   systemctl disable telnetd 2>/dev/null
   opkg remove telnet
   
   # Disable unauthenticated FTP
   systemctl disable vsftpd
   
   # Verify only intended ports are open
   netstat -tlnp | grep LISTEN
   # Should show only: SSH (22) on management interface, HTTPS (443) or MQTT-TLS (8883)
   

   /* In embedded RTOS (FreeRTOS/Zephyr) — only start services explicitly required */
   void network_init(void) {
       /* DO NOT start: Telnet server, unauthenticated HTTP, SNMP v1/v2 */
       mqtt_tls_client_start();   /* MQTT over TLS only */
       https_server_start();      /* HTTPS management only */
       /* All other services: compile out via Kconfig */
   }
   

2. Enforce TLS 1.2+ for all network communication:

   /* MQTT over TLS (Zephyr RTOS + Mbed TLS) */
   #include "mqtt_client.h"
   #include "mbedtls/ssl.h"
   
   struct mqtt_tls_config tls_cfg = {
       .peer_verify = TLS_PEER_VERIFY_REQUIRED,
       .cipher_list = "TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:"
                      "TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384",
       .ca_cert = broker_ca_cert,
       .ca_cert_len = sizeof(broker_ca_cert),
       /* Mutual TLS: device presents its own certificate */
       .client_cert = device_cert,
       .private_key = device_private_key,
   };
   
   struct mqtt_client_config  = {
       .broker = ,
       .port = ,  
       .tls = &tls_cfg,
   };
   

Rules

• Telnet must be disabled in production firmware — SSH with key authentication is the minimum acceptable for remote shell access.
• MQTT must use TLS (port 8883) — plaintext MQTT (port 1883) transmits device data and commands in the clear.
• Factory reset must not re-enable disabled services — the secure default must be the only default.
• Device certificates for mutual TLS must be unique per device — shared certificates mean compromising one device compromises all.

Common Mistakes

• Enabling Telnet "for debugging" and forgetting to disable in production build — use Kconfig or build flags to exclude debug services from release builds at compile time.
• VLAN segmentation without firewall rules — VLANs alone separate broadcast domains but don't enforce traffic policy; add firewall rules to block inter-VLAN routing.
• Self-signed certificates without certificate pinning — without pinning, any attacker with a CA can issue a valid certificate for your IoT broker; pin the specific CA or certificate.
• Exposing management interface on the same interface as data traffic — use separate network interfaces for management and data, or bind management to localhost only with SSH tunneling.