What is Amazon IoT Device Defender?
Use Amazon IoT Device Defender, a security and monitoring service, to audit the configuration of your devices, monitor connected devices, and mitigate security risks. With Amazon IoT Device Defender, you can enforce consistent security policies across your Amazon IoT device fleet and respond quickly when devices are compromised. IoT fleets can consist of large numbers of devices that have diverse capabilities, are long-lived, and are geographically distributed. These characteristics make fleet setup complex and error-prone. Because devices are often constrained in computational power, memory, and storage capabilities, this limits the use of encryption and other forms of security on the devices themselves.
Devices often use software with known vulnerabilities. These factors make IoT fleets an
attractive target for hackers and make it difficult to secure your device fleet on an ongoing
basis. Amazon IoT Device Defender addresses these challenges by providing tools to identify security issues and
deviations from best practices. Amazon IoT Device Defender can audit device fleets to confirm that they adhere to
security best practices and detect abnormal behavior on devices. The following diagram shows the
basic architecture of Amazon IoT Device Defender and how it relates to services such as Amazon IoT Core, Amazon CloudWatch, and
Amazon SNS.
Topics
Are you a first-time Amazon IoT Device Defender user?
If you're a first-time user of Amazon IoT Device Defender, we recommend that you begin by reading the following sections:
How Amazon IoT Device Defender works
Amazon IoT Device Defender is a fully managed security and monitoring service that helps you secure your fleet of IoT devices. Amazon IoT Device Defender audits IoT resources associated with your devices to confirm that they comply with security best practices. Audit checks send alerts if there are any detected security risks, and provide relevant information to help mitigate any issues. Amazon IoT Device Defender also continuously monitors security metrics from the cloud, and device-side to detect unexpected device behaviors to identify any possible compromised devices. You can launch audit checks on-demand or on a scheduled basis to assess your IoT device configurations.
Amazon IoT Device Defender works with Amazon IoT Core to incorporate the context of device interactions to increase the accuracy of audit checks. Amazon IoT Device Defender collects and analyzes high-value security metrics from your connected devices to detect abnormal behaviors. When you use Rules Detect, the metric data is continuously evaluated against user-defined behaviors. When you use ML Detect, the metric data is continuously evaluated by automatically built machine learning (ML) models to identify anomalies.
The results from scheduled audit tasks and any detected device activity anomalies are published to the Amazon IoT Console and Amazon IoT Device Defender API. They are accessible through Amazon CloudWatch. Additionally, you can configure Amazon IoT Device Defender to send results toAmazon SNS topics for integration with security dashboards or starting automated remediation workflows.
Amazon IoT Device Defender supports a wide range of use cases, including the following:
-
Protect your devices: You can audit your device-related resources against Amazon IoT security best practices
to help you detect device vulnerabilities. Amazon IoT Device Defender audits can help you identify and uncover risks to your devices, and confirm that security measures are in place. -
Detect unusual device behavior: You can pinpoint changes in connection patterns, reveal device communication with unauthorized endpoints, and identify changes in inbound and outbound device traffic patters.
-
Get insight to mitigate risks: You can take actions to mitigate issues uncovered in an Audit finding or Detect alarm.
-
Uphold and maintain device security: You can use insights from Audit and Detect checks to diagnose and remediate possible security breaches.
-
Enhance device security: You can distinguish an incorrectly configured device, probe the health of your device fleets, and locate unexpected device behavioral metrics.
Features of Amazon IoT Device Defender
The following are a few of the key features of Amazon IoT Device Defender.
| Audit |
Amazon IoT Device Defender audits your device-related resources against Amazon IoT security best practices. in the IAM User Guide Amazon IoT Device Defender reports configurations that are out of compliance with security best practices, such as overly permissive policies that can allow one device to read and update data for many other devices. |
| Rules Detect | Amazon IoT Device Defenderdetects unusual device behavior that can be indicative of a compromise by continuously monitoring high-value security metrics from the device and Amazon IoT Core. You can specify normal device behavior for a group of devices by setting up behaviors (rules) for these metrics. Amazon IoT Device Defender monitors and evaluates each datapoint reported for these metrics against user-defined behaviors (rules) and alerts you if an anomaly is detected. |
| ML Detect |
Amazon IoT Device Defender automatically sets device behaviors for you with machine learning (ML) models using device data across six cloud-side metrics and seven device-side metrics from a trailing 14-day period. It then retrains the models each day (as long as it has sufficient data to train the model) to refresh the expected device behaviors based on the latest trailing 14 days after initial models are built. Amazon IoT Device Defender monitors and identifies anomalous datapoints for these metrics with the ML models and sets off an alarm if an anomaly is detected. |
| Alerting | Amazon IoT Device Defender publishes alarms to the Amazon IoT Console, Amazon CloudWatch, and Amazon SNS. |
| Mitigation | Amazon IoT Device Defender can be used to investigate issues by providing contextual and historical information about the device such as device metadata, device statistics, and historical alerts for the device. You can also use Amazon IoT Device Defender built-in mitigation actions to perform mitigation steps on Audit and Detect alarms such as adding things to a thing group, replacing default policy version, and updating device certificate. |
How to get started with Amazon IoT Device Defender
For help getting started with Amazon IoT Device Defender, see the following tutorials.
Related services
-
Amazon IoT Greengrass: Amazon IoT Greengrass provides pre-built integration with Amazon IoT Device Defender to monitor device behaviors on an ongoing basis.
-
Amazon IoT Device Management: You can use Amazon IoT Device Management fleet indexing to index, search, and aggregate your Amazon IoT Device Defender detect violations.
Accessing Amazon IoT Device Defender
You can use the Amazon IoT Device Defender console or the API to access Amazon IoT Device Defender.
Pricing for Amazon IoT Device Defender
With Amazon IoT Device Defender, you only pay for what you use. There is no minimum fee or mandatory service
usage. However, you are billed separately for Audit and Detect features. Audit pricing is per
device count, per month. When you turn on Audit, you're charged based on the number of active
device principals