1

Do I need a gateway firewall to prevent attacks like DoS, if my IoT network can only talk to cloud using IPsec?

Even if there is need that can be implemented at cloud. Is there any need for it to present in IoT network?

Improve this question
1
  • 1
    I think this question is to broad and cannot be answered in general since the answer depends on the unknown actual design of your network and its connectivity and your unknown availability requirements.
    – Steffen Ullrich
    Commented Sep 1, 2018 at 12:22

2 Answers 2

Reset to default
1

Yes, you still need a firewall on your end. In the case of a DoS/DDoS, your connection would potentially be flooded to the point where your devices would not be able to establish the IPSEC tunnel and would therefore not function [properly]. If the firewall only exists on the cloud side, that does nothing for your service at your house/office.

A DoS/DDoS attack will probably not be stoppable no matter what equipment you have since it's happening at the connection level. Typically with a DoS/DDoS you deal with it further and further up the path as close to the source as can be. For example, you call your ISP so they can block it from getting to you, then they call their provider to have them block it before it gets to them, and so on. It can only be blocked so much before someone is left to take the hit but that's usually at the backbone level where they have more than enough bandwidth to deal with it until it is dealt with by other means (like finding the people causing it and stopping the attack).

Improve this answer
1

Since you've mentioned it's a closed network (connected through IPSEC), instead of deploying firewall and other traditional VPN (IPSEC) networks for your IoT network, you may try to implement SDP (Software defined perimeter) solutions.

You may refer details through wiki: https://en.wikipedia.org/wiki/Software_Defined_Perimeter

Or refer working group : https://cloudsecurityalliance.org/group/software-defined-perimeter/#_overview

This could be an alternative to traditional approaches and there are commercial solutions available to try out : https://www.perimeter81.com/software-defined-perimeter-enterprise

Improve this answer

Not the answer you're looking for? Browse other questions tagged .