Cybersecurity Model Based on Hardening for Secure Internet of Things Implementation
Source abstract
Abstract
The inclusion of Internet of Things (IoT) for building smart cities, smart health, smart grids, and other smart concepts has driven data-driven decision making by managers and automation in each domain. However, the hyper-connectivity generated by IoT networks coupled with limited default security in IoT devices increases security risks that can jeopardize the operations of cities, hospitals, and organizations. Strengthening the security aspects of IoT devices prior to their use in different systems can contribute to minimize the attack surface. This study aimed to model a sequence of seven steps to minimize the attack surface by executing hardening processes. Conducted a systematic literature review using Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) techniques. In this way, we were able to define a proposed methodology to evaluate the security level of an IoT solution by means of a checklist that considers the security aspects in the three layers of the IoT architecture. A risk matrix adapted to IoT is established to evaluate the attack surface. Finally, a process of hardening and vulnerability analysis is proposed to reduce the attack surface and improve the security level of the IoT solution.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: IoT and Edge/Fog Computing · Network Security and Intrusion Detection · Information and Cyber Security
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Escuela de Ingeniería en Tecnologías de la Información, FICA, Universidad de Las Américas, Quito 170125, Ecuador
Facultad de Ingeniería en Sistemas, Escuela Politécnica Nacional, Quito 170525, Ecuador
References (61)
Show source-provided references
1. Kaur, C. (2020). The Cloud Computing and Internet of Things (IoT). Int. J. Sci. Res. Sci. Eng. Technol., 19–22.10.32628/IJSRSET196657 ↗
2. Rajendran, G. (2019, January 1–3). Modern security threats in the Internet of Things (IoT): Attacks and Countermeasures. Proceedings of the 2019 International Carnahan Conference on Security Technology (ICCST), Chennai, India.10.1109/CCST.2019.8888399 ↗
3. Cyber Security and the Internet of Things: Vulnerabilities, Threats, Intruders10.13052/jcsm2245-1439.414 ↗
4. International Telecommunication Union (ITU) (2021, January 13). Definitions and Terminology Relating to Building Confidence and Security in the Use of Information and Communication. Available online: https://www.itu.int/net/itunews/issues/2010/09/pdf/201009_20.pdf.
5. (2021, January 13). The 20 CIS Controls & Resources Page. Available online: https://www.cisecurity.org/controls/cis-controls-list/.
6. Beckers, K., Heisel, M., Solhaug, B., and Stølen, K. (2014). ISMS-CORAS: A Structured Method for Establishing an ISO 27001 Compliant, Springer.10.1007/978-3-319-07452-8_13 ↗
7. De Oliveira, U.R., Augusto, F., Marins, S., Rocha, H.M., Antonio, V., and Salomon, P. (2017). The ISO 31000 Standard in Supply Chain Risk Management. J. Clean. Prod.10.1016/j.jclepro.2017.03.054 ↗
8. A guideline for software architecture selection based on ISO 25010 quality related characteristics
9. (2021, January 14). OWASP Internet of Things Project Page. Available online: https://wiki.owasp.org/index.php/OWASP_Internet_of_Things_Project.
10. Santos, L., Silva, E., Batista, T., Cavalcante, E., Leite, J., and Oquendo, F. (April, January 30). An architectural style for internet of things systems. Proceedings of the SAC ‘20: The 35th ACM/SIGAPP Symposium on Applied Computing, Brno, Czech Republic.
11. Leite, C., Gondim, J., Caetano, M.F., and Alchieri, E.A. (October, January 30). Pentest on Internet of Things Devices. Proceedings of the 2019 XLV Latin American Computing Conference (CLEI), Panama, Panama.10.1109/CLEI47609.2019.235111 ↗
12. Tien, C., Tsai, T., Chen, I., and Kuo, S. (2018, January 15–18). UFO-Hidden Backdoor Discovery and Security Verification in IoT Device Firmware. Proceedings of the 2018 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW), Memphis, TN, USA.10.1109/ISSREW.2018.00-37 ↗
13. Lee, M., Lee, K., Shim, J., Cho, S., and Choi, J. (2016). Security Threat on Wearable Services: Empirical Study using a Commercial Smartband. IEEE Int. Conf. Consum. Electron.10.1109/ICCE-Asia.2016.7804766 ↗
14. Zhang, W., Zhang, B., Zhou, Y., He, H., and Ding, Z. (2019). An IoT Honeynet based on Multi-port Honeypots for Capturing IoT attacks. IEEE Internet Things J., 1–9.
15. Li, K., Wen, H., Li, H., Zhu, H., and Sun, L. (2018). Security OSIF: Toward Automatic Discovery and Analysis of Event Based Cyber Threat Intelligence. IEEE SmartWorld Ubiquitous Intell. Comput., 741–747.10.1109/SmartWorld.2018.00142 ↗
16. Sengan, S., Subramaniyaswamy, V., Nair, S.K., Indragandhi, V., Manikandan, J., and Ravi, L. (2020). Enhancing cyber-physical systems with hybrid smart city cyber security architecture for secure public data-smart network. Future Gener. Comput. Syst.10.1016/j.future.2020.06.028 ↗
17. Visoottiviseth, V., Sakarin, P., Thongwilai, J., and Choobanjong, T. (2020, January 16–19). Signature-based and Behavior-based Attack Detection with Machine Learning for Home IoT Devices. Proceedings of the 2020 IEEE REGION 10 CONFERENCE (TENCON), Osaka, Japan.10.1109/TENCON50793.2020.9293811 ↗
18. Visoottiviseth, V., Akarasiriwong, P., Chaiyasart, S., and Chotivatunyu, S. (2017, January 5–8). PENTOS: Penetration Testing Tool for Internet of Thing Devices. Proceedings of the TENCON 2017-2017 IEEE Region 10 Conference, Penang, Malaysia.10.1109/TENCON.2017.8228241 ↗
19. Chu, G., Apthorpe, N., and Feamster, N. (2018). Security and Privacy Analyses of Internet of Things Children ’s Toys. IEEE Internet Things J.10.1109/JIOT.2018.2866423 ↗
20. Mohsin, M., Anwar, Z., Zaman, F., and Al-shaer, E. (2017). IoTChecker: A Data-driven Framework for Security Analytics of Internet of Things Configurations. Comput. Secur.10.1016/j.cose.2017.05.012 ↗
21. Akatyev, N., and James, J.I. (2017). Evidence Identification in IoT Networks Based on Threat Assessment. Future Gener. Comput. Syst.
22. Di Giorgio, A., Foglietta, C., Galli, A., Giuseppi, A., Liberati, F., Neri, A., Panzieri, S., Pascucci, F., Proenca, J., and Pucci, P. (2018). Integrated Protection of Industrial Control Systems from Cyber-attacks: The ATENA Approach. Int. J. Crit. Infrastruct. Prot.
23. Rizvi, S., Pipetti, R., Mcintyre, N., and Todd, J. (2020). Threat Model for Securing Internet of Things (IoT) Network at Device-Level. Internet Things, 100240.10.1016/j.iot.2020.100240 ↗
24. Matheu-García, S.N., Hernández-Ramos, J.L., Skarmeta, A.F., and Baldino, G. (2018). Risk-based Automated Assessment and Testing for the Cybersecurity Certification and Labelling of IoT Devices. Comput. Stand. Interfaces.10.1016/j.csi.2018.08.003 ↗
25. Khan, Y., and Ndubuaku, M. (2017, January 5–8). Ontology-Based Automation of Security Guidelines for Smart Homes. Proceedings of the 2018 IEEE 4th World Forum Internet Things, Penang, Malaysia.10.1109/WF-IoT.2018.8355214 ↗
26. Vulnerabilities Mapping based on OWASP-SANS: A Survey for Static Application Security Testing (SAST)10.33166/AETiC.2020.03.001 ↗
27. Teodoro, N., and Serrão, C. (2011, January 27–29). Web application security: Improving Critical Web-based Applications Quality through in-depth Security Analysis. Proceedings of the International Conference on Information Society (i-Society 2011), London, UK.10.1109/i-Society18435.2011.5978496 ↗
28. Mohino, J.D.V., Higuera, J.B., Ram, J., Higuera, B., Antonio, J., and Montalvo, S. (2019). The Application of a New Secure Software Development Life Cycle (S-SDLC) with Agile Methodologies. Electronics, 8.10.3390/electronics8111218 ↗
29. Rindell, K., Hyrynsalmi, S., and Leppänen, V. (2021). Fitting Security into Agile Software Development. Res. Anthol. Recent Trends Tools Implic. Comput. Program., 1026–1045.10.4018/978-1-7998-3016-0.ch047 ↗
30. Anderson, S., and Williams, T. (2017). Cybersecurity and medical devices: Are the ISO/IEC 80001-2-2 technical controls up to the challenge?. Comput. Stand. Interfaces, 1–10.10.1016/j.csi.2017.10.001 ↗
31. The internet of things in healthcare: Anoverview, challenges and model plan for security risks management process
32. Skierka, I.M. (2018). The governance of safety and security risks in connected healthcare. Living Internet Things Cybersecur. IoT, 1–12.10.1049/cp.2018.0002 ↗
33. An Information Security Risk Management Model for Smart Industries
34. Huang, X., and Nazir, S. (2020). Evaluating Security of Internet of Medical Things Using the Analytic Network Process Method. Secur. Commun. Netw., 1–14.10.1155/2020/8829595 ↗
35. Casola, V., De Benedictis, A., Rak, M., and Villano, U. (2019). Toward the automation of threat modeling and risk assessment in IoT systems. Internet Things, 100056.10.1016/j.iot.2019.100056 ↗
36. Ngamboé, M., Berthier, P., Ammari, N., Dyrda, K., and Fernandez, J.M. (2020). Risk assessment of cyber-attacks on telemetry-enabled cardiac implantable electronic devices (CIED). Int. J. Inf. Secur.10.1007/s10207-020-00522-7 ↗
37. Kieras, T., Farooq, M.J., and Zhu, Q. (2020). Modeling and Assessment of IoT Supply Chain Security Risks: The Role of Structural and Parametric Uncertainties. IEEE Symp. Secur. Priv.10.1109/SPW50608.2020.00043 ↗
38. Kandasamy, K., Srinivas, S., Achuthan, K., and Rangan, V.P. (2020). IoT cyber risk: A holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process. J. Inf. Secur.10.1186/s13635-020-00111-0 ↗
39. Lee, I. (2020). Internet of Things (IoT) Cybersecurity: Literature Review and IoT Cyber Risk Management. Future Internet, 12.10.3390/fi12090157 ↗
40. Ruan, K. (2019). Cyber Risk Measurement in the Hyperconnected World. Digital Asset Valuation and Cyber Risk Measurement: Principles of Cybernomics, Academic Press.10.1016/B978-0-12-812158-0.00004-1 ↗
41. Yigit, B., Gur, G., Alagoz, F., and Tellenbach, B. (2019). Cost-Aware Securing of IoT Systems Using Attack Graphs. Ad Hoc Netw., 23–25.10.1016/j.adhoc.2018.10.024 ↗
42. Maillet-Contoz, L., Michel, E., Brun, P., and Leprêtre, K. (2020). End-to-end security validation of IoT systems based on digital twins of end-devices. IEEE 2020 Glob. Internet Things Summit.10.1109/GIOTS49054.2020.9119570 ↗
43. Stine, I., Rice, M., Dunlap, S., and Pecarina, J. (2017). A cyber risk scoring system for medical devices. Int. J. Crit. Infrastruct. Prot.10.1016/j.ijcip.2017.04.001 ↗
44. New approach for threat classification and security risk estimations based on security event management10.1016/j.future.2020.07.015 ↗
45. Javed, B., Iqbal, M.W., and Abbas, H. (2017, January 21–25). Internet of Things (IoT) Design Considerations for Developers and Manufacturers. Proceedings of the 2017 IEEE International Conference on Communications Workshops (ICC Workshops), Paris, France.10.1109/ICCW.2017.7962762 ↗
46. IoT Security Foundation (2020). IoT Security Compliance Framework, IoTSF.
47. A survey of emerging threats in cybersecurity10.1016/j.jcss.2014.02.005 ↗
48. A Formal Model for a System’s Attack Surface10.1007/978-1-4614-0977-9_1 ↗
49. Identifying the Attack Surface for IoT Network10.1016/j.iot.2020.100162 ↗
50. Howard, M., Pincus, J., and Wing, J.M. (2005). Measuring Relative Attack Surfaces. Computer Security in the 21st Century, Springer.10.1007/0-387-24006-3_8 ↗
51. Gregg, M., and Santos, O. (2019). Certified Ethical Hacker (CEH) Version 10 Cert Guide, Pearson IT Certification. [3rd ed.].
52. (2019). Center for Internet Security CIS Controls 7.1, Center for Internet Security, Inc.
53. Automation of information security audit in the Information System on the example of a standard “CIS Palo Alto 8 Firewall Benchmark”10.30534/ijatcse/2020/182922020 ↗
54. Olencin, M., and Perha, J. (2019, January 20–22). Automated configuration of a Linux web server security. Proceedings of the 2019 IEEE 15th International Scientific Conference on Informatics, Poprad, Slovakia.10.1109/Informatics47936.2019.9119272 ↗
55. Mendes, N., Neto, A.A., Durães, J., Vieira, M., and Madeira, H. (2008, January 15–17). Assessing and Comparing Security of Web Servers. Proceedings of the 2008 14th IEEE Pacific Rim International Symposium on Dependable Computing, Taipei, Taiwan.10.1109/PRDC.2008.45 ↗
56. Neto, A.A., Vieira, M., and Madeira, H. (2009, January 18–23). An Appraisal to Assess the Security of Database Configurations. Proceedings of the 2009 Second International Conference on Dependability, Athens, Greece.10.1109/DEPEND.2009.17 ↗
57. Newman, G., and DeFuria, R. (2006). Security Control Verification and Monitoring Subsystem for Use in a Computer Information Database System. (8225409), U.S. Patent.
58. ScienceDirect VM2: Automated security configuration and testing of virtual VM2: Automated security configuration machine images and testing of virtual machine images10.1016/j.procs.2020.09.025 ↗
59. Samie, F., Bauer, L., and Henkel, J. (2016, January 2–7). IoT Technologies for Embedded Computing: A Survey. Proceedings of the International Conference on Hardware/Software Codesign and System Synthesis, Pittsburgh, PA, USA.10.1145/2968456.2974004 ↗
60. Audit dam implementasi CIS Benchmark pada sistem operasi Linux Debian Server
61. Radanliev, P., De Roure, D., Nurse, J.R.C., Nicolescu, R., Huth, M., Cannady, S., and Montalvo, R.M. (2020). Cyber risk impact assessment assessing the risk from the IoT to the digital Economy. SN Appl. Sci., 1–12.10.20944/preprints201903.0109.v2 ↗