Modeling Attacks in IoT to Assist the Engineering Process

• Autor(a) principal: Rodrigues, Luís Carlos Mendes
• Data de Publicação: 2020
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10400.6/11092
• topic: Internet das Coisas; Modelação de Ameaças; Modelação de Sistemas; Segurança Em Iot; Domínio/Área Científica::Engenharia e Tecnologia::Engenharia Eletrotécnica, Eletrónica e Informática

The Internet of Things is the broad name given to technologies that allow for any devices (known in this context as things) to communicate with each other as well as machines, applications, databases, among others in a seamless manner. This allows for devices in an environment such as in a home, a factory or a hospital, to interact with each other and even to autonomously perform actions based on the information they receive. This integration of technology in regular, everyday devices allows for the people that interact or otherwise are affected by them to have a finer degree of control over what is happening around them, allowing for this technology to improve other existing ones by improving their usefulness and efficiency. As a simple example, in the context of a smart home, a user can be able to manually command actions or to set conditions that trigger said actions according to his preferences. This means that things such as controlling room temperature and lighting, opening doors, ordering something when it runs out or turning appliances on, can be automatically performed when the conditions approved by the user are met. In medicine for example, Internet of Things (IoT) systems allow for the creation of more effective patient monitoring and diagnostic systems as well as resource management in general, as patients could potentially carry sensors that allow for constant monitoring thus assisting in diagnostics and in emergency situations. This last example raises an obvious and very important issue with this type of technologies, which is security. If IoT systems are not properly secured, a malicious actor could potentially access or modify private patient or hospital data as well as disable or tamper with the sensors, among other malicious scenarios that could potentially result in harm to equipment or even human lives. Given the speed at which this technology is evolving and new systems are being created and implemented, security is often seen as an afterthought, which results in insufficient or poorly implemented security measures allowing for attackers to easily disrupt the functioning or even to steal sensitive data from the system. Therefore, it is critical to perform an adequate security analysis right from the start of the system design process. By understanding the security requirements relevant to a system, it is possible to implement adequate security measures that prevent attacks or other malicious actions from occurring, thus safeguarding data and allowing for the system to perform as originally intended. The goal of this dissertation is to explore the principles behind system and threat modeling to be able to develop a prototype tool to assist users - even those with limited security knowledge - in the identification of security requirements, threats and good practices. Hopefully, this prototype should prove to be able to assist developers better define security requirements early in the system design stage, as well as including the correct defensive measures in the development stages. This prototype was developed in the context of the S E C U R I o T E S I G N project, as it integrates two other tools created in its context to assist in the identification of the requirements from information provided by the user. This dissertation produced a web application capable of handling the user inputs containing relevant system requirement and recommendations information, and then processing them in order to extrapolate the relevant system and threat modeling information. The validation process for this prototype consisted of comparing a manual system and threat analysis created by an expert, with the results obtained by volunteers using the prototype application, and verifying how correct is the analysis by the tool. The results were satisfying and the proposed objectives were successfully achieved.