15.262 14.9.22 Seguridad del edge
- SEC-01: Default-deny inbound network policy; expose only the local API/UI ports required by the deployment profile.
- SEC-02: Place camera and edge on a dedicated VLAN or physically bounded segment where feasible.
- SEC-03: Authenticate camera/device identity and pin expected device identifiers; IP address alone is not identity.
- SEC-04: Use TLS for remote synchronization and for LAN access when threat model requires it.
- SEC-05: Use role-based access for operator, coach, annotator, administrator and service identities.
- SEC-06: Do not run inference/API containers privileged; isolate the update agent as the minimal privileged component.
- SEC-07: Mount application containers read-only except declared volumes and temporary paths.
- SEC-08: Apply CPU, memory, PID and filesystem quotas; prevent one worker from exhausting the host.
- SEC-09: Store secrets outside images and logs; rotate and scope them to one destination/service.
- SEC-10: Encrypt storage when physical loss is in scope; document boot/unlock and recovery behavior.
- SEC-11: Redact athlete names, tokens, URLs and frame payloads from telemetry by default.
- SEC-12: Treat diagnostic frames and crash bundles as sensitive artifacts with separate retention/access.
- SEC-13: Audit authentication, authorization, export, deletion, update and model activation events.
- SEC-14: Verify all model, application and configuration artifacts before activation.
- SEC-15: Maintain SBOM/provenance and vulnerability review for release dependencies.
- SEC-16: Disable unused services, ports, package repositories and interactive shells in production profile.
- SEC-17: Pin base images by digest and use an approved JetPack/driver/runtime compatibility matrix.
- SEC-18: Run periodic restore, credential-revocation and rollback exercises.
- SEC-19: Apply consent and minor-data policies before export or synchronization.
- SEC-20: Separate production test data from developer access and benchmark quarantine.
- SEC-21: Use rate limits and request size limits on upload/import endpoints.
- SEC-22: Create incident bundles without silently uploading them; operator or policy controls export.
NIST SSDF propone integrar prácticas de seguridad en el ciclo de desarrollo. La arquitectura aplica esa idea a código, contenedores, modelos, configuración y proceso de actualización, no sólo al API [P49-R24].
15.262.1 Zonas de confianza
SensorEdge -> acquisition gateway -> TrustedEdge services
LocalUserLAN -> authenticated API -> domain services
TrustedEdge -> outbound sync -> RemoteUntrustedNetwork
Update media/registry -> verifier -> inactive release slot