Examkin

Question

Difficulty: MediumMobile Device and Embedded System Security

A network technician is installing smart environmental monitoring sensors throughout a corporate data center. These embedded IoT devices run a lightweight, proprietary firmware that cannot support endpoint security software or Mobile Device Management (MDM) agent enrollment. Which of the following strategies best secures these embedded devices against unauthorized access while protecting the internal network?

  1. Place the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules.Answer
  2. B
    Force the devices to enroll in the enterprise MDM portal to enforce full-device encryption policies.
  3. C
    Connect all sensors to the primary internal Wi-Fi network using WPA2-Personal with a shared passphrase.
  4. D
    Install physical tamper-evident enclosures on the sensors while leaving them on the main broadcast domain.

Answer

Placing the embedded sensors on a dedicated, logically isolated VLAN with restricted firewall rules is the best security approach.
Embedded systems and IoT devices frequently run restricted or proprietary operating systems that cannot support agent-based endpoint security software or MDM management. The industry standard approach for securing these devices is network segmentation (such as placing them on a dedicated VLAN) paired with restrictive firewall access control lists (ACLs) to ensure they cannot initiate unauthorized communication with internal corporate assets.

Step-by-Step Solution

1
Identify constraints of embedded IoT devices.
Recognize that these devices run specialized firmware unable to support standard MDM agents, antivirus software, or active endpoint management.
Embedded systems often have limited computing resources and non-standard operating systems.
2
Evaluate risk mitigation controls for unmanaged endpoints.
Determine that compensating network security controls, such as micro-segmentation and strict access control lists (ACLs), must be used.
Logical isolation limits the blast radius if an unmanaged embedded system is targeted or compromised.
3
Select the appropriate network isolation technique.
Assign the IoT devices to a separate virtual local area network (VLAN) isolated from production workstations and server subnets.
A separate VLAN enforces traffic restriction at the network boundary.

Key Concept

Embedded System Security & Network Isolation
Rate this question

Topics

Mobile Device and Embedded System Security

More questions from this topic