Securing Home IoT Devices Using MUD

Download the Final Draft Practice Guide

The NCCoE has released the final draft of NIST Cybersecurity Practice Guide SP 1800-15, Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD). Use the buttons below to view this publication in its entirety or scroll down for links to a specific section.

Download PDF » Open Web Version »

The National Cybersecurity Center of Excellence (NCCoE) has released the final draft of the National Institute of Standards and Technology’s (NIST’s) Cybersecurity Practice Guide Special Publication (SP) 1800-15, Securing Small-Business and Home Internet of Things (IoT) Devices: Mitigating Network-Based Attacks Using Manufacturer Usage Description (MUD). This practice guide is intended to show IoT device developers and manufacturers, network equipment developers and manufacturers, and service providers who employ MUD-capable components how to integrate and use MUD and other tools to satisfy IoT users’ security requirements.

The public comment period is now closed. Thank you to everyone who shared their feedback with us. View the current three volumes and the Functional Demonstration Results individually (see links below) or download the complete guide. To see a brief overview, read the two-page fact sheet.

SP 1800-15A: Executive Summary (pdf) (web)
SP 1800-15B: Approach, Architecture, and Security Characteristics (pdf) (web)
SP 1800-15C: How-To Guides (pdf) (web)
Supplement to Volume B: Functional Demonstration Results (pdf) (web)

If you have questions or suggestions, please email us at mitigating-iot-ddos-nccoe@nist.gov. Join our Community of Interest to receive email alerts and news about additional milestones.

The NCCoE and its collaborators have produced this practice guide to demonstrate the practicality and effectiveness of using the Internet Engineering Task Force’s Manufacturer Usage Description (MUD) Specification (RFC 8520) to strengthen security for IoT devices on home and small-business networks. This practice guide demonstrates how organizations can use MUD to reduce the vulnerability of IoT devices to network-based threats such as distributed denial of service attacks (DDoS) and mitigate the potential for harm resulting from exploitation of IoT devices. MUD works by enabling networks to automatically permit each IoT device to send and receive only the traffic it requires to perform as intended, while blocking unauthorized communication with the device.

Users can implement MUD via several different approaches. This practice guide describes four MUD implementations, three of which were documented in the previous version of this practice guide, and one of which (Build 3) is new in this version:

Build 1 uses products from Cisco Systems, DigiCert, Forescout and Molex.
Build 2 uses products from MasterPeace Solutions Ltd., Global Cyber Alliance (GCA), ThreatSTOP, and DigiCert.
Build 3 uses products from CableLabs and Digicert.
Build 4 uses software developed at the NIST Information Technology Laboratory Advanced Networking Technologies Division and products from DigiCert.

This project can help different stakeholder groups, including:

organizations that rely on the internet can understand how MUD can be used to protect internet availability and performance against network-based attacks.
IoT device manufacturers can learn how MUD can protect against reputational damage that may result from their devices being exploited to support DDoS or other network-based attacks.
service providers can benefit from a reduction of the number of IoT devices that can be easily used by malicious actors to participate in DDoS attacks against their networks and degrade service for their customers.
users of IoT devices can gain insight into how MUD-capable products can protect their internal networks from being subverted by malicious actors.

If you have questions or would like to join our Community of Interest, please email the project team at mitigating-iot-ddos-nccoe@nist.gov.

MUD-Related Resources

Find MUD-related resources and information, including standards, tools, implementations, research papers, articles, and conferences here.

Collaborating Vendors

Organizations participating in this project submitted their capabilities in response to an open call in the Federal Register for all sources of relevant security capabilities from academia and industry (vendors and integrators). The following respondents with relevant capabilities or product components (identified as “Technology Partners/Collaborators” herein) signed a Cooperative Research and Development Agreement to collaborate with NIST in a consortium to build this example solution.

_{Certain commercial entities, equipment, products, or materials may be identified by name or company logo or other insignia in order to acknowledge their participation in this collaboration or to describe an experimental procedure or concept adequately. Such identification is not intended to imply special status or relationship with NIST or recommendation or endorsement by NIST or NCCoE; neither is it intended to imply that the entities, equipment, products, or materials are necessarily the best available for the purpose.}

Join Our Community of Interest

Interested in joining the Securing Home IoT Devices Using MUD Community of Interest? Contact us!

A Community of Interest is a group of professionals and technical advisors convened to support the cybersecurity resiliency of the U.S. economy. Read More.