netfoundry.io Open in urlscan Pro
104.199.116.47  Public Scan

Submitted URL: https://email.netfoundry.io/e3t/Ctc/ON+113/cpY1h04/VWbQgk7w9qpnN7pz9RnqHKMDW58c1_754QXYsN7xs-wR3qgyTW7lCdLW6lZ3q3W6VLyHn7bXj...
Effective URL: https://netfoundry.io/iot-mtls/?utm_campaign=IoT%20%26%20Edge%20Networking%20Use%20Case&utm_medium=email&_hsmi=2790080...
Submission: On October 19 via api from US — Scanned from DE

Form analysis 2 forms found in the DOM

GET https://netfoundry.io/

<form class="form--horizontal" method="get" id="searchform" action="https://netfoundry.io/" data-hs-cf-bound="true">
  <div class="col-sm-8">
    <input type="text" name="s" placeholder="Type search keywords here" class="aa-input" autocomplete="off" spellcheck="false" role="combobox" aria-autocomplete="list" aria-expanded="false" aria-owns="algolia-autocomplete-listbox-0" dir="auto"
      style="">
    <pre aria-hidden="true"
      style="position: absolute; visibility: hidden; white-space: pre; font-family: &quot;Open Sans&quot;, Helvetica, Arial, sans-serif; font-size: 14px; font-style: normal; font-variant: normal; font-weight: 400; word-spacing: 0px; letter-spacing: normal; text-indent: 0px; text-rendering: auto; text-transform: none;"></pre>
  </div>
  <div class="col-sm-4">
    <button type="submit" class="btn btn--primary type--uppercase">Search</button>
  </div>
</form>

POST /iot-mtls/#wpcf7-f4993-p8312-o1

<form action="/iot-mtls/#wpcf7-f4993-p8312-o1" method="post" class="wpcf7-form init" aria-label="Contact form" novalidate="novalidate" data-status="init" data-hs-cf-bound="true">
  <div style="display: none;">
    <input type="hidden" name="_wpcf7" value="4993">
    <input type="hidden" name="_wpcf7_version" value="5.8">
    <input type="hidden" name="_wpcf7_locale" value="en_US">
    <input type="hidden" name="_wpcf7_unit_tag" value="wpcf7-f4993-p8312-o1">
    <input type="hidden" name="_wpcf7_container_post" value="8312">
    <input type="hidden" name="_wpcf7_posted_data_hash" value="">
  </div>
  <!--[if lte IE 8]>
  <script charset="utf-8" type="text/javascript" src="//js.hsforms.net/forms/v2-legacy.js"></script>
  <![endif]-->
  <p>
    <script charset="utf-8" type="text/javascript" src="//js.hsforms.net/forms/v2.js"></script><br>
    <script data-hubspot-rendered="true">
      hbspt.forms.create({
        portalId: '3452613',
        formId: '1c8d4392-1b8b-48a6-87df-18a77c193482',
        css: ''
      });
    </script>
  </p>
  <div id="hbspt-form-3915bf38-a52e-4a79-bba5-5228e9440dad" class="hbspt-form" data-hs-forms-root="true">
    <div class="hs_firstname hs-firstname hs-fieldtype-text field hs-form-field"><label id="label-firstname-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your First name"
        for="firstname-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>First name</span><span class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="firstname-1c8d4392-1b8b-48a6-87df-18a77c193482" name="firstname" required="" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="given-name" value=""></div>
    </div>
    <div class="hs_lastname hs-lastname hs-fieldtype-text field hs-form-field"><label id="label-lastname-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your Last name" for="lastname-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>Last
          name</span><span class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="lastname-1c8d4392-1b8b-48a6-87df-18a77c193482" name="lastname" required="" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="family-name" value=""></div>
    </div>
    <div class="hs_email hs-email hs-fieldtype-text field hs-form-field"><label id="label-email-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your Email" for="email-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>Email</span><span
          class="hs-form-required">*</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="email-1c8d4392-1b8b-48a6-87df-18a77c193482" name="email" required="" placeholder="" type="email" class="hs-input" inputmode="email" autocomplete="email" value=""></div>
    </div>
    <div class="hs_role hs-role hs-fieldtype-select field hs-form-field"><label id="label-role-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your Role" for="role-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>Role</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><select id="role-1c8d4392-1b8b-48a6-87df-18a77c193482" class="hs-input is-placeholder" name="role">
          <option disabled="" value="">Please Select</option>
          <option value="CxO/Executive">CxO/Executive</option>
          <option value="Sales/Marketing">Sales/Marketing</option>
          <option value="Software Development">Software Development</option>
          <option value="Digital Transformation">Digital Transformation</option>
          <option value="Network Focused">Network Focused</option>
          <option value="Cloud Focused">Cloud Focused</option>
          <option value="IoT Focused">IoT Focused</option>
          <option value="Database Focused">Database Focused</option>
          <option value="Operations">Operations</option>
          <option value="Finance">Finance</option>
          <option value="Human Resources">Human Resources</option>
          <option value="Customer Service">Customer Service</option>
          <option value="Other">Other</option>
        </select></div>
    </div>
    <div class="hs_country hs-country hs-fieldtype-text field hs-form-field"><label id="label-country-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your Country/Region"
        for="country-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>Country/Region</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><input id="country-1c8d4392-1b8b-48a6-87df-18a77c193482" name="country" placeholder="" type="text" class="hs-input" inputmode="text" autocomplete="country-name" value=""></div>
    </div>
    <div class="hs_state hs-state hs-fieldtype-select field hs-form-field"><label id="label-state-1c8d4392-1b8b-48a6-87df-18a77c193482" class="" placeholder="Enter your State / Province" for="state-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>State /
          Province</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><select id="state-1c8d4392-1b8b-48a6-87df-18a77c193482" class="hs-input is-placeholder" name="state">
          <option disabled="" value="">Please Select</option>
          <option value="N/A - Not in US">Not Applicable (NOT in North America)</option>
          <option value="Alabama">Alabama</option>
          <option value="Alaska">Alaska</option>
          <option value="Alberta">Alberta</option>
          <option value="Arizona">Arizona</option>
          <option value="Arkansas">Arkansas</option>
          <option value="British Columbia">British Columbia</option>
          <option value="California">California</option>
          <option value="Cleveland">Cleveland</option>
          <option value="Colorado">Colorado</option>
          <option value="Connecticut">Connecticut</option>
          <option value="Delaware">Delaware</option>
          <option value="District of Columbia">District of Columbia</option>
          <option value="Florida">Florida</option>
          <option value="Georgia">Georgia</option>
          <option value="Hawaii">Hawaii</option>
          <option value="Idaho">Idaho</option>
          <option value="Illinois">Illinois</option>
          <option value="Indiana">Indiana</option>
          <option value="Iowa">Iowa</option>
          <option value="Kansas">Kansas</option>
          <option value="Kentucky">Kentucky</option>
          <option value="Louisiana">Louisiana</option>
          <option value="Maine">Maine</option>
          <option value="Manitoba">Manitoba</option>
          <option value="Maryland">Maryland</option>
          <option value="Massachusetts">Massachusetts</option>
          <option value="Michigan">Michigan</option>
          <option value="Minnesota">Minnesota</option>
          <option value="Mississippi">Mississippi</option>
          <option value="Missouri">Missouri</option>
          <option value="Montana">Montana</option>
          <option value="Nebraska">Nebraska</option>
          <option value="Nevada">Nevada</option>
          <option value="New Brunswick">New Brunswick</option>
          <option value="New Hampshire">New Hampshire</option>
          <option value="New Jersey">New Jersey</option>
          <option value="New Mexico">New Mexico</option>
          <option value="New York">New York</option>
          <option value="Newfoundland and Labrador">Newfoundland and Labrador</option>
          <option value="North Carolina">North Carolina</option>
          <option value="North Dakota">North Dakota</option>
          <option value="Northwest Territories">Northwest Territories</option>
          <option value="Nova Scotia">Nova Scotia</option>
          <option value="Nunavut">Nunavut</option>
          <option value="Ohio">Ohio</option>
          <option value="Oklahoma">Oklahoma</option>
          <option value="Ontario">Ontario</option>
          <option value="Oregon">Oregon</option>
          <option value="Pennsylvania">Pennsylvania</option>
          <option value="Prince Edward Island">Prince Edward Island</option>
          <option value="Puerto Rico">Puerto Rico</option>
          <option value="Quebec">Quebec</option>
          <option value="Rhode Island">Rhode Island</option>
          <option value="Saskatchewan">Saskatchewan</option>
          <option value="South Carolina">South Carolina</option>
          <option value="South Dakota">South Dakota</option>
          <option value="Tennessee">Tennessee</option>
          <option value="Texas">Texas</option>
          <option value="Utah">Utah</option>
          <option value="Vermont">Vermont</option>
          <option value="Virginia">Virginia</option>
          <option value="Washington">Washington</option>
          <option value="Washington , D.C.">Washington D.C.</option>
          <option value="West Virginia">West Virginia</option>
          <option value="Wisconsin">Wisconsin</option>
          <option value="Wyoming">Wyoming</option>
          <option value="Yukon">Yukon</option>
        </select></div>
    </div>
    <div class="hs_message hs-message hs-fieldtype-textarea field hs-form-field"><label id="label-message-1c8d4392-1b8b-48a6-87df-18a77c193482" class=""
        placeholder="Enter your What can we help you with /other blog topics you would like us to explore?" for="message-1c8d4392-1b8b-48a6-87df-18a77c193482"><span>What can we help you with /other blog topics you would like us to
          explore?</span></label>
      <legend class="hs-field-desc" style="display: none;"></legend>
      <div class="input"><textarea id="message-1c8d4392-1b8b-48a6-87df-18a77c193482" class="hs-input hs-fieldtype-textarea" name="message" placeholder=""></textarea></div>
    </div>
    <div class="hs_recaptcha hs-recaptcha field hs-form-field">
      <div class="input">
        <div class="grecaptcha-badge" data-style="inline" style="width: 256px; height: 60px; box-shadow: gray 0px 0px 5px;">
          <div class="grecaptcha-logo"><iframe title="reCAPTCHA" width="256" height="60" role="presentation" name="a-fj8c7bdpv14n" frameborder="0" scrolling="no"
              sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox"
              src="https://www.google.com/recaptcha/enterprise/anchor?ar=1&amp;k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&amp;co=aHR0cHM6Ly9uZXRmb3VuZHJ5LmlvOjQ0Mw..&amp;hl=en&amp;v=MydHw_zggsxIJuhSbyOmPv5R&amp;size=invisible&amp;badge=inline&amp;cb=87iqw27b8w59"></iframe>
          </div>
          <div class="grecaptcha-error"></div><textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response"
            style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"></textarea>
        </div><iframe style="display: none;"></iframe>
      </div><input type="hidden" name="g-recaptcha-response" id="hs-recaptcha-response" value="">
    </div>
    <div class="hs_submit hs-submit">
      <div class="hs-field-desc" style="display: none;"></div>
      <div class="actions"><input type="submit" class="hs-button primary large" value="Submit"></div>
    </div><input name="hs_context" type="hidden"
      value="{&quot;embedAtTimestamp&quot;:&quot;1697755420045&quot;,&quot;formDefinitionUpdatedAt&quot;:&quot;1654883007386&quot;,&quot;lang&quot;:&quot;en&quot;,&quot;notifyHubSpotOwner&quot;:&quot;true&quot;,&quot;userAgent&quot;:&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36&quot;,&quot;pageTitle&quot;:&quot;IoT mTLS - NetFoundry&quot;,&quot;pageUrl&quot;:&quot;https://netfoundry.io/iot-mtls/?utm_campaign=IoT%20%26%20Edge%20Networking%20Use%20Case&amp;utm_medium=email&amp;_hsmi=279008060&amp;_hsenc=p2ANqtz--xolumRC5sIF5awijRW0CnWvjGahLkViWmPtTzg1HhI9EFA62pa1HKQ1nsH58Rxb85htYdc6keDYagxW7i3NM9lQQa8g&amp;utm_content=279008060&amp;utm_source=hs_email&quot;,&quot;urlParams&quot;:{&quot;utm_campaign&quot;:&quot;IoT &amp; Edge Networking Use Case&quot;,&quot;utm_medium&quot;:&quot;email&quot;,&quot;_hsmi&quot;:&quot;279008060&quot;,&quot;_hsenc&quot;:&quot;p2ANqtz--xolumRC5sIF5awijRW0CnWvjGahLkViWmPtTzg1HhI9EFA62pa1HKQ1nsH58Rxb85htYdc6keDYagxW7i3NM9lQQa8g&quot;,&quot;utm_content&quot;:&quot;279008060&quot;,&quot;utm_source&quot;:&quot;hs_email&quot;},&quot;isHubSpotCmsGeneratedPage&quot;:false,&quot;hutk&quot;:&quot;02140385b9293bebf6da504a7a3363bc&quot;,&quot;__hsfp&quot;:1768103610,&quot;__hssc&quot;:&quot;13322536.1.1697755421509&quot;,&quot;__hstc&quot;:&quot;13322536.02140385b9293bebf6da504a7a3363bc.1697755421509.1697755421509.1697755421509.1&quot;,&quot;formTarget&quot;:&quot;#hbspt-form-3915bf38-a52e-4a79-bba5-5228e9440dad&quot;,&quot;locale&quot;:&quot;en&quot;,&quot;timestamp&quot;:1697755421527,&quot;originalEmbedContext&quot;:{&quot;portalId&quot;:&quot;3452613&quot;,&quot;formId&quot;:&quot;1c8d4392-1b8b-48a6-87df-18a77c193482&quot;,&quot;region&quot;:&quot;na1&quot;,&quot;target&quot;:&quot;#hbspt-form-3915bf38-a52e-4a79-bba5-5228e9440dad&quot;,&quot;isBuilder&quot;:false,&quot;isTestPage&quot;:false,&quot;isPreview&quot;:false,&quot;css&quot;:&quot;&quot;,&quot;isMobileResponsive&quot;:true},&quot;correlationId&quot;:&quot;3915bf38-a52e-4a79-bba5-5228e9440dad&quot;,&quot;renderedFieldsIds&quot;:[&quot;firstname&quot;,&quot;lastname&quot;,&quot;email&quot;,&quot;role&quot;,&quot;country&quot;,&quot;state&quot;,&quot;message&quot;],&quot;captchaStatus&quot;:&quot;LOADED&quot;,&quot;emailResubscribeStatus&quot;:&quot;NOT_APPLICABLE&quot;,&quot;isInsideCrossOriginFrame&quot;:false,&quot;source&quot;:&quot;forms-embed-1.3938&quot;,&quot;sourceName&quot;:&quot;forms-embed&quot;,&quot;sourceVersion&quot;:&quot;1.3938&quot;,&quot;sourceVersionMajor&quot;:&quot;1&quot;,&quot;sourceVersionMinor&quot;:&quot;3938&quot;,&quot;_debug_allPageIds&quot;:{},&quot;_debug_embedLogLines&quot;:[{&quot;clientTimestamp&quot;:1697755420170,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved pageContext values which may be overriden by the embed context: {\&quot;pageTitle\&quot;:\&quot;IoT mTLS - NetFoundry\&quot;,\&quot;pageUrl\&quot;:\&quot;https://netfoundry.io/iot-mtls/?utm_campaign=IoT%20%26%20Edge%20Networking%20Use%20Case&amp;utm_medium=email&amp;_hsmi=279008060&amp;_hsenc=p2ANqtz--xolumRC5sIF5awijRW0CnWvjGahLkViWmPtTzg1HhI9EFA62pa1HKQ1nsH58Rxb85htYdc6keDYagxW7i3NM9lQQa8g&amp;utm_content=279008060&amp;utm_source=hs_email\&quot;,\&quot;userAgent\&quot;:\&quot;Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.88 Safari/537.36\&quot;,\&quot;urlParams\&quot;:{\&quot;utm_campaign\&quot;:\&quot;IoT &amp; Edge Networking Use Case\&quot;,\&quot;utm_medium\&quot;:\&quot;email\&quot;,\&quot;_hsmi\&quot;:\&quot;279008060\&quot;,\&quot;_hsenc\&quot;:\&quot;p2ANqtz--xolumRC5sIF5awijRW0CnWvjGahLkViWmPtTzg1HhI9EFA62pa1HKQ1nsH58Rxb85htYdc6keDYagxW7i3NM9lQQa8g\&quot;,\&quot;utm_content\&quot;:\&quot;279008060\&quot;,\&quot;utm_source\&quot;:\&quot;hs_email\&quot;},\&quot;isHubSpotCmsGeneratedPage\&quot;:false}&quot;},{&quot;clientTimestamp&quot;:1697755420172,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved countryCode property from normalized embed definition response: \&quot;DE\&quot;&quot;},{&quot;clientTimestamp&quot;:1697755421523,&quot;level&quot;:&quot;INFO&quot;,&quot;message&quot;:&quot;Retrieved analytics values from API response which may be overriden by the embed context: {\&quot;hutk\&quot;:\&quot;02140385b9293bebf6da504a7a3363bc\&quot;}&quot;}]}"><iframe
      name="target_iframe_1c8d4392-1b8b-48a6-87df-18a77c193482" style="display: none;"></iframe>
  </div>
</form>

Text Content

We use cookies to give you the best experience possible. To find out more about
the cookies we use, see our Privacy Policy.
Accept Decline
 * Cloud
    * AWS Zero Trust Networking
    * Azure Zero Trust Networking
    * Oracle Zero Trust Networking
    * Multicloud Zero Trust Networking

 * IoT Security
 * Zero Trust
    * Zero Trust APIs
    * App-embedded Zero Trust
    * Zero Trust DevOps

 * Resources
    * Who We Are
    * Meet The Team
    * Join Us
    * News
    * Blog
    * Pricing
    * Compliance and Security
    * Case Studies and Whitepapers
    * Downloads
    * Partners
       * Partner Portal
       * Become a Partner
       * Our Trusted Partners
   
    * Support
    * Contact Us
    * Solution Recipes

 * Open Source
    * OpenZiti
    * Zrok

Try CloudZiti For Free Contact Sales


IOT MTLS

March 1, 2023 in IoT, mTLS

Mutual TLS (mTLS) for IoT was one of the most requested features from our IoT
customers, so we are happy to announce that it is now globally available in our
IoT remote management and networking solution.  It is the same Ziti platform
capability used for our API solution, app-embedded secure networking and IT
remote access solutions, so it has hundreds of millions of sessions under its
belt.  It is available for both OpenZiti (open source zero trust networking
platform) and CloudZiti (NetFoundry’s managed Ziti NaaS with hosted Ziti network
fabric).

In this post, we take a step back to describe mTLS and the differences between
TLS and mTLS.  We then outline criteria by which you can determine if the mTLS
option matches your IoT use case needs.  We discuss how mTLS itself works in
general, and specifically how it works as part of a Ziti-powered IoT overlay
network.

Do you care about mTLS for IoT?

Most of us are familiar with TLS from the web.  TLS tells our client/browser
that the website we are visiting has proven (via a cryptographically
authenticated X.509 certificate) that the web server is who it says it is. 
Think of this as the validation of the identity of one party.

Mutual TLS also validates the identity of the IoT client (in addition to
validating the IoT server).  So mTLS helps your IoT server validate that the IoT
clients are who they say they are.  It looks like this:

In a solution like NetFoundry’s, which combines IoT mTLS with an IoT overlay
network fabric which only accepts authenticated endpoints, the net result is
your IoT server no longer needs to be open to the Internet – you deny all
inbound traffic (your IoT servers and clients both open outbound sessions to its
private IoT overlay network fabric).

So, if you *don’t* care about IoT server security or management, then this post
is probably not for you.  If you *do* manage IoT servers, then this post is for
you.

Is mTLS for IoT a better solution than TLS, VPN (or private mobile APN) or
firewall ACLs?

Engineering answer: it depends.  With that out of the way, let’s look at general
guidelines for the use (or not) of mTLS in IoT.

IoT mTLS versus TLS

TLS will generally be simpler and easier.   And simpler can mean more secure and
scalable.   If you are in a situation in which you can explicitly trust any
device which has the ability to connect to your IoT server, and the data you are
dealing with is not very valuable or sensitive, then TLS may be for you.

If you are concerned with attacks on your IoT server, for example because you
are dealing with sensitive or valuable data, then mutual TLS is a great
solution.  In fact, most IoT operators would default to mTLS in that situation,
except managing certificates and PKI is often difficult and complex (which is
why NetFoundry customers asked us to build it into its IoT solution).  Note: we
are using PKI as shorthand for the set of tools, policies, and procedures needed
to mint, enroll, manage, distribute, update and revoke digital client
certificates (like X.509s).

IoT mTLS versus VPN or private mobile APN

This comparison mainly hinges on the number of sites, the amount of change and
latency requirements.  At one extreme, if you have a few sites, and they are
relatively static, then you can probably afford the operational overhead of
VPN.  Likewise, if you are ok with site #1 tunneling all of its data to site #2,
then VPN backhaul may be ok for you (split tunnel can be done but is made
difficult by VPN architectures).

Mutual TLS scales far better, e.g. across 10s to 1000s of sites.  And, if mTLS
is paired with dynamic routing (it is in the NetFoundry IoT remote management
and networking solution), then one IoT endpoint or gateway can simultaneously
send (or receive) data from (n) number of other endpoints (eliminate backhaul). 
This is important for IoT deployments which need latency reduction (avoid VPN or
private APN backhaul), or cost reduction (avoid backhauling all data to one
cloud and then paying extra cloud egress costs to get the data to where it
actually needs to go).  Note: private mobile APNs and VPNs are essentially the
same in the context of this conversation – both result in a default single
tunnel backhaul VPN to one site.

IoT mTLS versus firewall ACLs

IP-address based ACLs has become somewhat of a default solution for folks who do
want to protect their API servers, but don’t want to implement mTLS (prior to
the availability of solutions like the NetFoundry solution which provide the IoT
mTLS PKI). ACLs can work well for a limited number of endpoints with static
public IPs and a low rate of change.

Dependencies on IP addresses and ACLs becomes difficult for large deployments
(lots of IPs), overlapping RFC 1918 space, the need to get static public IPs (or
do port forwarding) and dealing with IP address changes.  Meanwhile, IP
addresses are weak identifiers from a security perspective (as compared to mTLS
X.509s…more on that below).

So, similar to VPNs, IoT mTLS is often the better choice for deployments which
have many endpoints, strict security and compliance requirements or high rates
of change.

IoT mTLS security model

Let’s not claim mutual TLS is more secure than TLS, VPN or firewall ACLs without
describing the solution so you can judge for yourself.

Most security models should start with identity.  Mutual TLS is no different. 
Specifically, X.509 certificates replace the use of IP addresses for identity
(the certs can be other types but X.509 is dominant).  These certs authenticate
IoT client and device connections.  In the NetFoundry solution, without this
authentication, the devices can’t connect to the Ziti overlay network fabric,
which means they can’t connect to your IoT servers (your IoT servers are no
longer open to the Internet – you close the inbound firewall ports – and instead
your servers will now only talk to mTLS authenticated clients, with all
communication initiated outbound.

Why are X.509 certificates a good basis for identity and authentication?  First
of all, X.509 certificates enable asymmetric keys, taking advantage of the power
of public-private key cryptography. You can store private keys in places like
TSMs so that the cryptographic material never leaves your device.   Because the
private key never leaves the device, it is far stronger than credentials which
can be hijacked, phished or brute forced such as passwords or codes passed by
text message.  Furthermore, they don’t require human interaction with the IoT
device.

In the case of the NetFoundry solution, the Ziti controllers will validate the
cert against its Certificate Authority (CA).  You can optionally add your own CA
to the chain of trust.  The Ziti controller challenges the client for proof of
ownership of the private key that corresponds to the public key contained in the
certificate.  Part of the magic of the solution is making the PKI (enrollment,
validation and management process) simple.  Check out this blog post series if
you want more detail on it.

IoT option summary – is mutual TLS a silver bullet for IoT security?

No.  The first question is if you need to secure your IoT servers.  Even if you
do, then mTLS is just one important layer.  Whether IoT mTLS is for you depends
largely on the factors listed above.  If you do need IoT mTLS, and you want to
combine it with an IoT network overlay in order to remove your IoT servers from
any network exposure, then NetFoundry’s IoT management and networking solution
looks like this:


Discuss On:
LinkedInFacebookTwitterRedditHacker NewsEmailWordPressShare

LinkedInFacebookTwitterRedditHacker NewsEmailWordPressShare

SEARCH

Search

INTERESTED IN MORE INFORMATION?




First name*

Last name*

Email*

Role
Please SelectCxO/ExecutiveSales/MarketingSoftware DevelopmentDigital
TransformationNetwork FocusedCloud FocusedIoT FocusedDatabase
FocusedOperationsFinanceHuman ResourcesCustomer ServiceOther
Country/Region

State / Province
Please SelectNot Applicable (NOT in North
America)AlabamaAlaskaAlbertaArizonaArkansasBritish
ColumbiaCaliforniaClevelandColoradoConnecticutDelawareDistrict of
ColumbiaFloridaGeorgiaHawaiiIdahoIllinoisIndianaIowaKansasKentuckyLouisianaMaineManitobaMarylandMassachusettsMichiganMinnesotaMississippiMissouriMontanaNebraskaNevadaNew
BrunswickNew HampshireNew JerseyNew MexicoNew YorkNewfoundland and LabradorNorth
CarolinaNorth DakotaNorthwest TerritoriesNova
ScotiaNunavutOhioOklahomaOntarioOregonPennsylvaniaPrince Edward IslandPuerto
RicoQuebecRhode IslandSaskatchewanSouth CarolinaSouth
DakotaTennesseeTexasUtahVermontVirginiaWashingtonWashington D.C.West
VirginiaWisconsinWyomingYukon
What can we help you with /other blog topics you would like us to explore?








PREVIOUS POST ZERO TRUST APIS

NETFOUNDRY BLOG

NEXT POST ENABLING AI SERVICE PROVIDERS TO SECURELY SERVE CUSTOMERS

© 2023 NetFoundry Privacy Policy Legal Support
 * 
 * 
 * 


✓
Thanks for sharing!
AddToAny
More…