View the threat list
Enterprise Edition instances of IoT Platform in the China (Shanghai) and China (Beijing) regions offer a security threat detection service that continuously monitors devices for threats. This topic lists the check items and explains how to view and handle any threats found.
Prerequisites
The security threat detection service is enabled for the target Enterprise Edition instance. For instructions, see Enable the service.
Check items
|
Check item |
Description |
|
Unencrypted device connection |
The device connects to IoT Platform using an unencrypted protocol. This vulnerability can lead to man-in-the-middle (MITM) hijacking and replay attacks, potentially compromising your services. |
|
Legacy TLS protocol |
Legacy TLS protocols, such as TLS v1.0 and v1.1, contain known vulnerabilities. Exploiting them can lead to threats like data breaches. |
|
Device identity leak and conflict |
Multiple devices are sharing the same identity credentials. This can cause devices to go offline intermittently and lead to security threats such as data leaks. |
|
Device identity leak (one-type-one-secret) |
In a one-type-one-secret scenario, multiple devices are sharing the same identity credentials. This can cause devices to go offline intermittently and lead to security threats such as data leaks. |
|
Brute-force attack on device identity |
An attacker has compromised a device's identity credentials through a brute-force attack. This can force legitimate devices offline and lead to threats such as theft of business data. |
|
Device authentication failure |
The device failed to connect due to incorrect authentication credentials. This can disrupt your services. |
|
Unusual logon location detection |
An IoT device connects from multiple cities within a short period, frequently disconnecting and reconnecting. This behavior can indicate that multiple devices are sharing the same identity credentials or that the credentials have been leaked, which can lead to security threats like data breaches. Important
This check item is disabled by default. After enabling the security detection service for your instance, you can enable this check item as needed. To enable this feature: On the page of the IoT Security Center console, click Task Management. On the Task Management panel, click Enable in the Actions column of Unusual Logon Location Detection. |
View and handle threats
Log on to the IoT Platform console.
-
On the Overview page, find the instance that you want to manage and click the instance ID or instance name.
-
In the left-side navigation pane, choose .
-
On the Threat List page, review the list of devices with detected threats. The list displays information such as threat types and processing status.
You can filter the list by searching for a Product Name or Device Name, or by selecting a time range.
-
In the threat list, find a threat and click View in the Actions column to see its details.
In the threat details dialog box, the Basic Information section lists details such as Product Name, Device Name, Discovery Time, Threat Type, and Threat Information. The Threat Information field describes the specific threat, for example, a device connecting without encryption.
-
Return to the threat list. For a threat with an Unhandled status, click Handle to view the remediation suggestion.
The remediation suggestion offers guidance, for example: "The communication link is unencrypted. We recommend using an encrypted protocol such as TLS v1.2 or later." If you are already using a proprietary encryption protocol like iTLS (used for ID² access), you can change the Processing Status to Handled. Otherwise, keep the status as Unhandled. Then, click OK.
-
After you fix the device as suggested, select Resolved and click OK.
The threat's processing status changes to Handled.
You can enable security threat notifications to receive detection results from IoT Security Center by email. For instructions, see Configure notifications.