When devices are compromised.
WHAT TO ESTABLISH FIRST
Scope: which devices, and what they can do.
WHY THE SECOND PART
Devices that can act physically require immediate containment.
WHAT CONTAINMENT MEANS
Isolating affected devices from the network Revoking their credentials Disabling their ability to act
WHAT TO PRESERVE
Logs and device state, before changing anything.
WHAT MAKES IOT INCIDENTS HARDER
Devices may be numerous and distributed Physical access may be required Evidence is limited Remediation may require an update that takes time
WHAT TO PREPARE IN ADVANCE
The ability to disable a device or group remotely The ability to push an emergency update Contact details for affected customers A defined decision process
WHY IN ADVANCE
Building these during an incident is too slow.
WHAT TO COMMUNICATE
What happened What devices are affected What customers should do When it will be resolved
WHAT REGULATION MAY REQUIRE
Notification within defined periods.
WHAT TO DO AFTERWARDS
Establish how it happened Fix the cause across the fleet Verify remediation on every device
WHY VERIFICATION MATTERS
Devices that never received the fix remain compromised.
