Security & Access Control
Security & Access Control
Strong security and access control practices are essential for protecting IoT.live deployments, operational workflows, and sensitive business data.
The following recommendations can help reduce:
- Unauthorised access
- Operational risk
- Misconfiguration
- Data exposure
- Security-related incidents
[IMAGE PLACEHOLDER: Security and access control overview]
Enforce Multi-Factor Authentication (MFA)
MFA significantly improves account security by requiring an additional verification step during sign-in.
Recommended MFA practices include:
- Enforcing MFA for all administrators
- Using authenticator apps where possible
- Limiting fallback methods appropriately
- Reviewing MFA adoption regularly
Supported MFA methods may include:
- Authenticator apps
- Email verification codes
Administrative accounts should always use MFA.
Use role-based access control
Grant users only the permissions required for their operational responsibilities.
Recommended role separation may include:
- Billing access
- Device operations
- Batch operations
- User administration
- Audit visibility
- eSIM management
This helps reduce:
- Accidental operational changes
- Unauthorised access
- Security exposure
[IMAGE PLACEHOLDER: Role-based access example]
Limit administrative access
Administrative privileges should be restricted to authorised operational users only.
Recommended practices include:
- Regular access reviews
- Removing unused accounts
- Restricting global administrator roles
- Reviewing shared access usage
Excessive administrative access increases operational and security risk.
Review user access regularly
Periodic reviews help identify:
- Obsolete accounts
- Excessive permissions
- Former employee access
- Inactive operational users
Recommended review frequency:
- Monthly for administrative access
- Quarterly for standard operational access
Protect API credentials securely
API keys and provider credentials should be treated as sensitive operational secrets.
Recommended controls include:
- Secure credential storage
- Restricted access
- Credential rotation policies
- Monitoring API usage
- Removing unused integrations
[IMAGE PLACEHOLDER: API credential management]
Exposed API credentials may allow unauthorised operational actions or data access.
Monitor Audit Trail activity
Audit Trail monitoring helps identify:
- Unexpected operational changes
- Suspicious login activity
- Failed operational workflows
- Unauthorised configuration updates
- Excessive permission usage
Recommended monitoring includes:
- Administrative actions
- Failed login attempts
- Batch operation failures
- High-impact operational changes
Restrict export access
Exports may contain:
- Device identifiers
- Customer information
- Billing data
- Operational activity
- Audit records
Recommended controls include:
- Limiting export permissions
- Reviewing billing visibility
- Restricting customer datasets
- Following organisational data governance policies
[IMAGE PLACEHOLDER: Export permissions controls]
Use secure operational workflows
Before executing high-impact operational changes:
- Validate affected device groups
- Review operational scope
- Confirm provider compatibility
- Export operational snapshots
- Monitor Batch Operations closely
This is especially important for:
- eSIM migrations
- Native mode updates
- Rate plan changes
- Bulk operational workflows
Remove obsolete integrations and accounts
Regularly review:
- Unused provider integrations
- Inactive users
- Obsolete saved searches
- Unused operational tags
- Expired API credentials
This helps reduce:
- Security exposure
- Operational complexity
- Administrative overhead
Prepare for operational incidents
Organisations should establish processes for:
- Credential compromise
- Operational rollback
- Failed migrations
- Provider outages
- Unauthorised access investigations
Recommended preparation includes:
- Operational exports
- Audit retention
- Access reviews
- Escalation procedures
- Backup operational contacts
Security and operational governance requirements may vary depending on organisational policies and regulatory obligations.