Module 6: IOT security and vulnerability solution
CO6: Introduce various security issues in IoT
Q) List and draw security functional group components in IOT reference architecture.
Following are five functional components (FCs):
1. Identity management (IdM)
2. Authentications
3. Authorization
4. Key exchange and management
5. Trust and reputation
Q. Draw the layerd attacker model and explain possible attacks in IOT/M2M.
Q) Describe Tomography and layered attacker model in IOT.
Computational tomography means a computing method of producing a three-dimensional picture
of the internal structures of an object, by observation and recording of the differences in effects on
passage of energy waves impinging on those structures. Computational security in complex set of
networks utilizes the network tomography procedures of identifying the network vulnerabilities.
This enables design of efficient attack strategies. A complex set of networks may be distributed or
collaborative. Network tomography refers to the study of vulnerabilities and security aspects for
network monitoring in a complex system, such as WSNs, RFIDs or IoT networks and allocating
resources and ensuring network reliability and security.
Monitoring of individual nodes is not fast acting and is also impractical. Network tomography
helps in observing each network section (for example, a WSN nodes network between two access
points) and subsections. The security tomography means finding attack vulnerable
sections/subsections from the observations for behaviours using a finite number of objects or
threats in a complex set of subsystems.
Q) Explain security vulnerability in IOT
IoT security vulnerabilities stem from weak or default passwords, lack of encryption, insecure
network services, and insecure update mechanisms. Because many IoT devices are designed with
limited processing power and a focus on connectivity over security, they often have outdated
firmware, lack robust security features, and can have their physical security compromised. These
weaknesses can lead to unauthorized access, data breaches, and devices being used in botnets for
larger attacks.
Common IoT vulnerabilities
Weak or default passwords: Many devices ship with hardcoded or easily guessable passwords,
making them simple to access.
Unencrypted data: Transmitting data without encryption means it can be intercepted and viewed
by attackers on the same network.
Insecure network services: Devices may run services like HTTP, FTP, or Telnet with inadequate
security, providing an entry point for attackers.
Insecure update mechanisms: A lack of a secure way to update the device's firmware leaves
vulnerabilities unpatched. If updates are not possible, the device remains permanently vulnerable.
Outdated components: Devices can be vulnerable due to using old operating systems or firmware
with known security flaws.
Lack of physical hardening: Physical access can allow attackers to extract sensitive data or
tamper with the device's firmware and hardware.
Insecure ecosystem interfaces: Vulnerabilities in the cloud, mobile apps, or web APIs connected
to the device can be exploited to gain access to the device itself.
Limited processing power: The small size and low power consumption of many IoT devices
means they lack the resources to implement strong security measures like robust encryption or
security agents.
OWASP has identified top ten vulnerabilities in IoT applications/services as follows:
● Insecure web interface
● Insufficient authentication or authorisation
● Insecure network services
● Lack of transport encryption/integrity verification
● Privacy concerns
● Insecure cloud interface
● Insecure mobile interface
● Insufficient security configurability
● Insecure software or firmware
● Poor physical security
Q) Discuss various securities vulnerabilities in IOT and potential solutions .
IoT security vulnerabilities stem from weak authentication, insecure networks, and outdated
components, but can be solved with solutions like implementing strong, unique passwords,
regularly updating firmware, encrypting data, and segmenting networks. Other solutions include
using two-factor authentication, enabling physical security, and disabling unnecessary services to
create a layered defense.
Vulnerabilities
Weak authentication: Using default or easily guessable passwords is a major vulnerability.
Insecure networks: Unprotected networks allow unauthorized access to devices and data.
Outdated components: Using devices with outdated software or firmware leaves them exposed
to known exploits.
Insecure data handling: Transmitting, storing, or displaying data without proper encryption.
Insecure interfaces: Vulnerabilities in the user interfaces or ecosystem interfaces that allow
access to the device or its data.
Lack of updates: No secure mechanism for updating firmware and software, leaving devices
vulnerable to new threats.
Solutions
Change default credentials: Replace all default passwords with strong, unique passwords.
Enable two-factor authentication (2FA): Add a second layer of security to the login process.
Network segmentation: Create a separate guest network for IoT devices to isolate them from
more sensitive devices and your main network.
Regular updates and patching: Apply security patches and updates for firmware and software
as soon as they become available.
Use encryption: Ensure that data is encrypted both when it is transmitted and when it is stored.
Secure your network: Configure your firewall to block unnecessary network services on IoT
devices.
Enable physical security: Use tamper-resistant devices and ensure they are physically secure
where possible.
Disable unnecessary features: Turn off any features or services on the device that are not needed.
Q) Explain the IOT security requirements
IoT security requirements focus on protecting devices, networks, and data through strong
authentication, data encryption, and secure communication. Key requirements include managing
device identity, ensuring the integrity and confidentiality of data both in transit and at rest, and
maintaining the security of software and firmware through updates and patching. Other vital
aspects are maintaining availability, controlling access, and ensuring the system can scale and
adapt to threats while meeting industry regulations.
Device and access security
Device authentication: Ensure only authorized devices can access the network by providing them
with unique identities.
Strong passwords and access control: Enforce strong passwords and use role-based access
control to limit who can access devices and data.
Secure boot: Verify that a device boots up with only trusted, authorized software to prevent
malicious code from running from the start.
Physical security: Protect devices in exposed locations with tamper resistance and hardware
security features to prevent physical attacks.
Data and communication security
Data encryption: Encrypt data both when it's being sent over the network (in transit) and when
it's stored on a device (at rest).
Data integrity: Make sure data cannot be tampered with or corrupted during transmission or
storage.
Secure communications: Use secure protocols, like TLS/DTLS, to encrypt data in transit between
devices and the network.
Management and maintenance
Firmware and software updates: Regularly update firmware and software to patch
vulnerabilities and protect against new threats.
Monitoring and logging: Continuously monitor device and network activity to detect anomalies
and security events, and keep detailed logs for investigation.
Secure provisioning and deprovisioning: Ensure devices are securely onboarded with identity
validation and can be securely removed from the network when no longer in use.
Device recovery: Have a mechanism to restore compromised or malfunctioning devices to a
known-good state or securely wipe their data.
Compliance and scalability
Regulatory compliance: Meet industry-specific compliance standards and regulations to ensure
the IoT system is legal and secure for its intended use.
Scalability: Design security solutions that can operate effectively at the scale of the entire IoT
ecosystem, including managing potentially millions of devices.