Cluster Computing

https://doi.org/10.1007/s10586-018-2823-6 (0123456789().,-volV)(0123456789().,-volV)

Internet of Things: information security challenges and solutions

Natalia Miloslavskaya1 • Alexander Tolstoy1

Received: 8 November 2017 / Revised: 5 February 2018 / Accepted: 17 July 2018

 Springer Science+Business Media, LLC, part of Springer Nature 2018

Abstract
Keeping up with the burgeoning Internet of Things (IoT) requires staying up to date on the latest network attack trends in
dynamic and complicated cyberspace, and take them into account while developing holistic information security (IS)
approaches for the IoT. Due to multiple vulnerabilities in the IoT foundations, many targeted attacks are continuing to
evolve. This survey of related work in the very specialized field of IS assurance for the IoT develops a taxonomy of typical
attacks against IoT assets (with special attention to IoT device protection). Based on this taxonomy, the key directions for
countering these attacks are defined. According to the modern demand for the IoT and big IS-related data processing, we
propose applying the Security Intelligence approach. The results obtained, when compared with the related work and
numerous analogues, are based on the following research methodology: view the IoT as a security object to be protected,
leading to understanding its vulnerabilities and possible attacks against the IoT exploiting these vulnerabilities, and from
there approaches to protecting the IoT. A few areas of the future research, among which the IoT operational resilience and
usage of the blockchain technology seem to us the most interesting, are indicated.

Keywords Internet of Things
Information security
Vulnerability
Attack taxonomy
Countering attacks against the IoT

Security intelligence application
Big data application

1 Introduction to transmit data to and from cloud-based resources (like

management interfaces), many targeted attacks such as
In the dynamic and complicated cyberspace, the Internet of distributed denial-of-service (DDoS) and main-in-the-
Things (IoT) is becoming more pervasive. It includes middle (MitM), buffer overflow, malicious modification,
everything from blood pressure meters, home TVs, brute force password cracking and many others are con-
restaurant refrigerators, and connected cars to robotic tinuing to evolve for the IoT.
manufacturing, smart grid and countless industrial control According to the research and consulting company Frost
systems, all of which are interconnected and send or and Sullivan (https://ww2.frost.com), 40% of all data
receive data from various mobile applications and cloud generated by 2020 will come from multiply connected IoT
services. To keep up with this burgeoning IoT, it is sensors. The well-known company Gartner (http://www.
imperative to stay up to date with the latest network attack gartner.com) predicts that IoT device usage will grow from
trends and take them into account in developing holistic 6.4 billion in 2016 to 11.4 billion in 2018, while 25%
IoT information security (IS) approaches. Due to multiple cyberattacks will involve the IoT by 2020. Neustar (https://
vulnerabilities in the Internet‘s foundations, standard www.neustar.biz) supplements this picture: 81% of the
communication protocols that connect IoT devices to each companies that adopted IoT suffered from DDoS attacks in
other and the global Internet, such as HTTP, that are used 2015, and from January through November 2016, 48% of
the identified attacks against the IoT that Neustar mitigated
used multiple vectors. In their report Cybersecurity
& Natalia Miloslavskaya Essentials for 2017 they wrote: ‘‘The ubiquity of the IoT
[email protected] devices—and their exploitation—will continue to pose a
1
formidable threat next year. IoT devices, coupled with the
National Research Nuclear University MEPhI (Moscow
Engineering Physics Institute), 31 Kashirskoye Shosse, effectiveness of ransomware, phishing, and malware will
Moscow, Russia 115409 most likely reveal inroads to create lucrative chaos in

123
 Cluster Computing

organizations. As a consequence, 2017 will produce introduced in Sect. 3. Section 4 is devoted to a short
unlimited opportunity and the potential for bad actors to introduction of the main IoT features and recent vulnera-
achieve objectives that include theft, disruption, extortion, bilities used to launch attacks against the IoT. Section 5
and impact’’ [1]. briefly describes the most interesting attacks against the
IS for the IoT potentially includes everything from our IoT and presents their classification, based on their thor-
everyday lives, from organizations’ industrial control sys- ough analysis. Section 6 defines the key approaches to
tems and IP-connected television in their conference rooms countering these attacks. A few areas of future research,
to smart fire or temperature sensors and clinical (biomed- among which IoT operational resilience and use of block-
ical) devices. Compromising industrial control systems chain technology seem to us the most interesting, are
could have many cyberwarfare consequences for critical indicated in the conclusion.
infrastructures. The television could be an entry point to
organizations’ intranets. The smart sensors and other
equipment could contain information of value to a com- 2 Related work
petitor. The clinical devices could affect patient’s health
and ultimately life. Hence, ensuring that those devices The IoT is a relatively new concept. It is still in its early
operate in a secure configuration is crucially important. stages (according to Cisco experts’ consolidated opinion,
As the IoT is a network without clearly defined edges, the term first appeared between 2008 and 2009). Despite
the traditional IS approaches with perimeter-focused the term’s usage for a several years, no single definition has
strategies no longer work. Therefore, we decided to con- been agreed to yet. Among the most widely used is the
duct a SWOT analysis for the IoT to make an organized list following: the IoT is ‘‘a global infrastructure for the
of the IoT’s greatest Strengths, Weaknesses, Opportunities information society, enabling advanced services by inter-
and Threats. At the beginning we very briefly show the IoT connecting (physical and virtual) things based on existing
concept strengths and opportunities. After that we define its and evolving interoperable information and communica-
implementation weaknesses in the form of vulnerabilities tion technologies’’ made by Recommendation ITU-T
and then list threats in the form of network attacks and their Y.2060 [3]. In its simplest form, the IoT can be viewed as a
taxonomy. But the objectives of the article go beyond the system of interrelated computing devices, mechanical and
SWOT analysis. Our article is aimed not only at the sys- digital machines, objects, people and even animals that are
tematization of vulnerabilities and attacks against the IoT provided with unique identifiers and the ability to transfer
elements (with special attention to IoT device protection), data over a network without requiring human-to-human or
but also at the key directions of countering these attacks to-computer interaction [4]. In [5], the IoT refers to a
and their support via the application of Security Intelli- network of physical objects (devices, vehicles, buildings
gence (SI) approaches as well as defining further and other items embedded with electronics, software,
prospective research directions. To achieve this goal the sensors and network connectivity) that enables these
article is based on the following research methodology and objects to collect and exchange data. In [6], the physical
logic, presented by us in [2]: view the IoT as a security objects are added by the virtual objects that have unique
object to be protected, leading to understanding its vul- identities and are connected to the Internet to facilitate
nerabilities and possible attacks against the IoT exploiting intelligent applications that make energy, logistics, indus-
these vulnerabilities, and from there approaches to pro- trial control, retail, agriculture and many other domains
tecting the IoT. We believe that the main contribution of ‘‘smarter’’. In our opinion, ‘‘the network of objects of
our article when compared with the related work and different natures’’ at the beginning of the phrase is more
numerous analogues is the application of such a method- correct. Hence, the IoT unites anything at any place via any
ology. Here we intentionally give only a reference to the time communication.
description of this methodology described elsewhere in The IoT overview from different points of view is pre-
detail [2], since this topic is beyond the scope of this sented in [6–11]. The textbook [8] on the IoT is written for
article. educational institutions and IoT vendors and service pro-
The article targets a wide audience of experts in the viders who may be interested in offering a broader per-
fields of IoT and its IS assurance. We believe that it is also spective of the IoT to accompany their own customer and
helpful to those readers who are not familiar enough with developer training programs. In [10], the IoT is called the
such areas. second wave of a powerful digital revolution that began
Thus, the article is organized as follows. Section 2 with the widespread adoption of computers in the
presents a short background of our research (with the 1970–1980s. But the authors note that its potential comes
exception of privacy issues requiring separate detailed with plenty of intended consequences: new types of crime,
consideration). The IoT main features and topology are

123
Cluster Computing

weapons and warfare, and many security and privacy The IoT Village project (https://www.iotvillage.org/), as
issues. In [7], there is only a small section on security. a sort of conference within the conference at DEF CON,
Such a ‘‘hot topic’’ as IoT security gave rise to a large requires special mention. It was organized by the security
number of publications. In our further research we have consulting and research firm Independent Security Evalu-
adopted the concepts of systematic literature review [12] as ators (ISE) for the purpose of advocating for, and deliv-
a way to analyze and structure them. We think it reasonable ering expertise on, security advancements in the IoT
to group them into two categories. Some publications are devices.
devoted to more general issues while the others discuss As proof that many publications in 2017 were devoted to
security for one specific IoT element (for example, a general reviews of ensuring IS for the IoT, we would like to
specific IoT device) or only one type of security controls mention only some of the latest journal articles like
(for example, cryptography). [17–21] and conference papers like [22–26]. Despite the
At present there are a few specialized books on IoT undoubtedly great contribution to this field (namely
security [13–16]. The book [13] explores how attackers can reviewing various security attacks and countermeasures in
abuse popular IoT-based devices like wireless LED light the three tiers of IoT—perception, network and applica-
bulbs, electronic door lockers, smart TVs, connected cars, tion), unfortunately not more than four pages are on the
etc., and their tactics. In [14], a set of guidelines to archi- topic itself.
tect and deploy a secure enterprise IoT, namely how to Of course, this is not a complete list of publications that
build a security program, to select individual components we have analyzed since the beginning of our research. But
affecting the security posture of the entire system, to design they are the most revealing of modern research areas,
a secure IoT using systems security engineering and pri- attracting the greatest attention of theorists and
vacy-by-design principles, and to leverage cloud-based practitioners.
systems to support the IoT is provided. The author of [15] Thus, we define the following prevailing directions of
presents attack models of IoTs with countering principles, ongoing research in ensuring IS for the IoT:
details the security design of sensors and devices linked
• The IoT security concept from theoretical and practical
into IoTs, discusses new IoT network security protocols,
views;
examines IoT back-end security issues (trust and authen-
• Guidelines to architect and deploy a secure industrial
tication), and analyzes privacy preservation schemes. The
and enterprise’s IoT;
small-volume book [16] just published in 2017 explains the
• The IoT back-end security issues: identification,
IoT security concept from theoretical and practical view-
authentication, access control and trust;
points, which take into account end-node resource limita-
• More general hardware (edge devices, sensor, gate-
tions, IoT hybrid network architecture, communication
ways, etc.) security;
protocols and applications characteristics.
• Communication security and new secure protocols for
On the other hand, someone can find even more papers
the IoT;
and article on this topic. If you use the two words ‘‘IoT’’
• Application security (for clouds, smart homes, mobile
and ‘‘security’’ as a search criteria in the Scopus and
systems, etc.);
WebofKnowledge databases, many titles will be returned
• The IoT security management;
as an answer to your search. For example, the search for
• The IoT security standards; and
2017 only returned 1740 items from Scopus, 596 items
• Privacy preservation (being out of the scope of this
from WebofKnowledge and 1191 items from the IEEE
article).
digital library (access date 04/02/2018)!
Many reports have been presented at various interna- We would like to highlight the last-named direction
tional conferences on this booming field of IoT security. because of its great importance as there is a great deal of
Some examples from 2017 are the 4th EAI International ongoing work in the IoT open standards development. The
Conference on Safety and Security in IoT—Valencia strongest contributors to the field are the following: The
(Spain), the IoT Security Summit—New York City (USA), Open Connectivity Foundation (https://openconnectivity.
the International Workshop on Secure IoT—Oslo (Nor- org), The Internet of Things Expert Group of the European
way), DEF CON 25 IoT Village—Las Vegas (USA), the Commission (http://ec.europa.eu/transparency/regexpert/
Security of Things World—Berlin (Germany), and the IoT index.cfm?do=groupDetail.groupDetail&groupID=2514),
World Summit Russia 2017 (Kazan, Tatarstan). We The Open Group Internet of Things Work Group (http://
deliberately do not list them all here; otherwise their www.opengroup.org/getinvolved/workgroups/iot), The
analysis will surpass the allowed length of this article many Open Geospatial Consortium (http://www.opengeospatial.
times. org/docs/is), The International Telecommunication Union
(http://www.itu.int/en/ITU-T/gsi/iot/Pages/default.aspx),

123
 Cluster Computing

The IEEE–SA Internet of Things (http://standards.ieee.org/ immediate real-time response and do not have a long
innovate/iot), The Special Working Group ISO/IEC JTC time to analyze anomalous activity in order to detect
1/SWG 10 on the Internet of Things ISO/IEC, and the Joint some malicious actor’s intrusion;
Subcommittee ISO/IEC JTC 1/SC 41 on Internet of Things • Cloud networks as the basic tool to control/maintain
and Related Technologies. The majority of their standards IoT, the IS of which should also be separately and
are still in the preliminary stages of development, and as thoroughly studied and adequate solutions found to
they are adopted, we will add them to our study. Hence, ensure it;
ensuring IS for the IoT remains an active research area. • Default configurations and accounts being used;
• The absence of anti-virus and anti-malware solutions;
• No mutual authentication of connected devices and no
3 Brief introduction of the IoT main features unified Public Key Infrastructure (PKI); and
and topology • Lack of standardization and so on.
A typical generic four-layer IoT topology consists of
Based on the rigorous study of the above related works
sensor-equipped edge devices on a wired or wireless net-
[6–11, 13–27] and generalizing their main findings, we
work sending data via a gateway to a public or private
describe the following key IoT features that are crucial for
cloud as shown in Fig. 1 [27]. Its layers are the following:
further IoT IS analysis because of their great influence on
it: (1) Link layer. It supports the IoT smart physical devices
linking to the network and further to the Internet
• Open, self-organized and fully distributed architectures
using Ethernet, Wi-Fi, 802.15.4, Bluetooth, ZigBee,
(as opposite to predefined architectures of existing
6LoWPAN, RPL, WiMax, 3G, 4G, 5G and other
networks), meaning that new elements may connect to
communication protocols. A few examples of simple
it without preliminary verification for their IS level, the
IoT devices are Radio-Frequency Identification
data may move in all directions, the back-end systems
(RFID) devices, Near Field Communication (NFC)
usually aggregate and analyze all the data, and the very
devices, Surface Acoustic Wave (SAW) devices, and
many communication points where a malicious actor is
complex IoT devices, which are based on micro-
able to break into the IoT and its elements’ accounts;
controllers or microprocessors such as smart meters,
• The high number of Internet-facing IoT devices,
traffic flow sensors, medical products (like glucome-
drastically increasing the number of entry points to
ters, insulin pumps, blood pressure cuffs and so on),
the IoT;
connected vehicle systems, and industrial control
• The IoT data is designed to move freely between
systems.
devices and locations, as well as across network
(2) Router/smart hub layer. It supports devices that are
environments, remote offices, mobile workers and
designed to help multiple smart devices connect to
public cloud environments. This IoT feature makes it
difficult to consistently track and secure all data
streams. The problem is aggravated by the volume,
speed and heterogeneity of the data in the IoT (it can be
considered as a typical IoT big data challenge);
• Many smart devices’ manufacturers collect usage/
performance statistics from their devices or update
firmware to fix bugs, all of which happens over insecure
communication channels of the IoT;
• Most smart devices with limited computing capabilities
are useful for incorporating into botnets (hence the term
thingbots);
• It is possible for various heterogeneous networks
(mobile and sensor networks, medicine networks,
VANET, etc.) to be integrated together into one IoT,
but currently IS issues occur at different levels—for
example, the protocols of some systems have more
vulnerabilities than in other systems;
• Ultra-low latency networks (e.g., some applications of
medicine networks, the tactile Internet, etc.), require
Fig. 1 The IoT topology

123
Cluster Computing

the Internet by creating a hotspot that they can developers, and consumers better understand the security
‘hook’ onto. issues associated with the IoT.
(3) Session/communication layer. It manages how var- To understand the scale of the problem, we will give just
ious applications connect to the Internet via HTTP/ one fact: during the IoT Village held at the DEF CON 25
HTTPS. security conference in August 2016, 47 new vulnerabilities
(4) Internet/cloud layer. It is usually the final destination affecting 23 devices from 21 manufacturers (including
of data. Data sent to and from this layer is usually refrigerators, thermostats, smart door locks, padlocks and
stored in datacenters. even wheelchairs and solar panel arrays) were disclosed
during the IoT security talks, workshops and on-site
These layers are managed by protocols (except UDP)
hacking contests [28]. ‘‘The types of vulnerabilities found
based on the rules that govern each layer and ensure that
ranged from poor design decisions like the use of plaintext
the data passing through them get to where they are going,
and hard-coded passwords to coding flaws like buffer
while remaining intact.
overflows and command injection’’, as stated in [28]. And
The typical topology can vary broadly from application
over the past 3 years at DEF CON (since DEF CON 23),
to application (in Fig. 1 it is indicated by App). For
the IoT Village has served as the platform in which 113
example, in some cases the gateway may be on the device
vulnerabilities were found and displayed in connected IoT
(that is, may be built into the device). In other cases,
devices.
devices based on such topologies may be built from the
Our vision of the IoT targets that can be attacked due to
ground up to leverage IoT (Green Field on the right side) or
unresolved vulnerabilities is presented in Table 1. The first
may be legacy devices that will have IoT capabilities added
two rows refer to the IoT information assets. The third row
post-deployment (Brown Field on the left side) [27].
reflects different views of the IoT devices (hardware) and
By exploiting identification, data capture, processing
their typical vulnerabilities. The remaining rows present
and communication capabilities, the IoT makes full use of
the IoT software vulnerabilities. The given table does not
things to offer services to all kinds of applications, whilst
pretend to be complete, and so can be used as a framework
fulfilling IS and privacy requirements [6]. And vice versa;
for extension as new IoT information and non-information
all these layers with corresponding things on them (called
assets can appear in the future.
security objects) can be considered as the targets of attacks
To specify and illustrate the identified vulnerabilities,
against the IoT.
one can use the National Vulnerability Database (NVD) of
the Computer Security Research Center of the National
Institute of Standards and Technology (NIST) (https://nvd.
4 IoT vulnerabilities facilitating attacks’
nist.gov/vuln/search). The NVD contains 34 records on the
implementation
IoT vulnerabilities found between January and December
2017 (Table 2). These vulnerabilities are assigned severity
After introducing the IoT features in general as security
scores from 5.3 to 9.8 (on a scale from 0 to 10) using the
objects to be protected, we are ready to specify the IoT IS
Common Vulnerability Scoring System (CVSS), version 3;
landscape and to highlight the main recent vulnerabilities
these scores represent a range from medium to high and
exploited for launching attacks against the IoT.
even critical severity. As can be seen from the table, 12
First of all, let us define the IoT vulnerabilities as the
vulnerabilities are extremely critical, 20 have high severity
properties of the IoT assets (including those properties of
and only 2 have medium severity.
the information protection tools (IPTs) that are used in the
All these vulnerabilities, individually or in any combi-
IoT) exploited by an individual IS threat source for the
nation, can be used to attack the IoT described below,
realization of IS threats against the IoT [2]. In turn, an IS
and—what is more dangerous—many of them can be
threat (short from ‘‘a threat of IS violation’’) is a set of
exploited remotely.
conditions and factors that create an actual or potential
opportunity for violation of the IoT assets’ IS [2]. An IS
threat source/actor/agent is a person, a material object, or a
physical event realizing the IS threat [2].
5 Typical attacks against the IoT
One of the well-known sources of information for IoT
To support IoT functionality, data moves in all directions
vulnerabilities, which we studied in detail, is the analysis
and the back-end systems usually aggregate and analyze all
being conducted by the IoT Project within the framework
the data. With so many points of communication with the
of the Open Web Application Security Project (OWASP)
IoT, a malicious actor is able to break into system accounts,
(https://www.owasp.org/index.php/IoT_Attack_Surface_
starting his/her activity with a password-based attack using
Areas), which is designed to help manufacturers,
brute-force cracking, guessing or stealing passwords, then

123
 Cluster Computing

Table 1 The IoT typical vulnerabilities, exploited by attacks against various IoT targets
IoT attacks’ targets IoT vulnerabilities

IoT information Local data storage (data at rest) Unencrypted data, data encrypted with discovered keys, lack of data integrity checks, etc.
assets Any data in streams circulating in the IoT channels (communications and network traffic) Vulnerabilities that are primarily
related to the network protocols. They allow checks, scans, run of commands, deprovisioning, pushing updates, non-
standard and short-range traffic, vulnerable network traffic encryption, etc.
IoT devices Memory Cleartext usernames and passwords, vulnerable encryption keys and third-party credentials, etc.
(hardware) Physical Interfaces Firmware extraction, user and administrative command line interface (CLI), possibility of privilege
escalation, reset to insecure state and removal of storage media, etc.
Web Interfaces Typical well-known vulnerabilities causing SQL injection (SQLi), cross-site scripting (XSS), cross-site
request forgery (CSRF), username enumeration, weak passwords, account lockout, known default credentials, etc.
Firmware Hardcoded credentials, sensitive information and URL disclosure, vulnerable encryption keys, firmware version
display and/or last update date, etc.
Network Services Information disclosure, user and admin CLI, injection vulnerabilities, vulnerabilities used for DoS
attacks, unencrypted services, poorly implemented encryption, vulnerabilities causing buffer overflow, vulnerable test/
development procedures and services, vulnerable UDP services, and universal plug and play (UPnP)
IoT software Access control Implicit trust between IoT assets; problems with enrollment security and decommissioning systems; poorly
designed access procedures, etc.
Update mechanism Updates sent without encryption or unsigned, update location writable, update verification, Malicious
update, missing update mechanism, no manual update mechanism, etc.
Administrative and cloud web interfaces Typical well-known vulnerabilities enabling SQLi, XSS, CSRF, username
enumeration, weak passwords, account lockout, known default credentials, vulnerable security/encryption options and
logging options, inability to wipe an IoT device, insecure password recovery mechanism, lack of transport encryption,
etc.
Mobile application Implicitly trusted by device or cloud, username enumeration, account lockout, known default
credentials, weak passwords, insecure data storage, lack of transport encryption, insecure password recovery mechanism,
etc.
Third-party backend and vendor backend APIs Inherent trust of cloud or mobile application, weak authentication, weak
access controls, device information leaked, location leaked, vulnerabilities causing injection attacks, etc.

modify the specific configuration of a given IoT device, with parts that allow unauthorized access or generate
and steal sensitive data from the device (called data exfil- incorrect results.
tration or extracting) from anywhere in the IoT, or launch a Many smart devices’ manufacturers collect usage/per-
DoS attack. formance statistics from their devices, which are frequently
Another challenge is the large number of Internet-facing sent over insecure communication channels. This allows
IoT devices, which drastically increases the number of interception of such traffic in order to block, manipulate, or
entry points to the IoT. The reality is that most IoT devices falsify (tamper) data or attach malicious payloads. ‘‘You
are not designed with IS assurance in mind; they do not have to design the hardware and firmware from the ground
have a traditional operating system or even much memory, up to prevent access from malware or physical tampering,’’
their processing power is not enough to build in security or said Ken Jones, vice president of engineering and product
install a security client, etc. Some of these devices are management at IronKey. ‘‘It is extremely common that
vulnerable to identity spoofing (the acquisition and use of firmware can be updated in the field to fix bugs and security
correct authentication credentials belonging to others in vulnerabilities, but once you have that process and don’t
order to gain access to a device or an otherwise restricted think it through fully, you have opened a Pandora’s box of
service, while these credentials can be obtained directly problems’’ [29]. According to Jones, secure design should
from a device, sniffing/eavesdropping on communication include protection against physical tampering of devices,
channels, or by social engineering/phishing) or use as encryption and firmware digital signatures. ‘‘… It is all
alternative network gateways (in addition to vulnerabilities about what you allow to connect to your network, using
of the authorized IoT gateways themselves). For example, endpoint protection that can block everything except
sensors are susceptible to counterfeiting and replacement whitelisted products,’’ Jones said.
by fake products with malware/malicious code, as well as The core IoT network infrastructure can be hacked,
malicious modification/replacement of their components allowing unencrypted data to be passed through them to be
intercepted (sniffed) by a malicious actor. If data is

123
Cluster Computing

Table 2 The NIST NVD 2017 IoT vulnerabilities

CVSS Vulnerability ID and its summary
severity

9.8 critical CVE-2017-11497 Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP
SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via language packs containing filenames
longer than 1024 characters
CVE-2017-11496 Stack buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP
SRM 2.10 to Sentinel LDK 7.50, allows remote attackers to execute arbitrary code via malformed ASN.1 streams in V2C and
similar input files
CVE-2017-12865 Stack-based buffer overflow in ‘‘dnsproxy.c’’ in connman 1.34 and earlier allows remote attackers to cause a
denial of service (crash) or execute arbitrary code via a crafted response query string passed to the ‘‘name’’ variable
CVE-2017-7728 On iSmartAlarm cube devices, there is authentication bypass leading to remote execution of commands (e.g.,
setting the alarm on/off), related to incorrect cryptography
CVE-2017-8289 Stack-based buffer overflow in the ipv6_addr_from_str function in sys/net/network_layer/ipv6/addr/
ipv6_addr_from_str.c in RIOT prior to 2017-04-25 allows local attackers, and potentially remote attackers, to cause a denial of
service or possibly have unspecified other impact via a malformed IPv6 address
CVE-2015-2888 Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to bypass authentication,
related to the MySnapCam web service
CVE-2015-2887 iBaby M3S has a password of admin for the backdoor admin account
CVE-2015-2885 Lens Peek-a-View has a password of 2601hx for the backdoor admin account, a password of user for the
backdoor user account, and a password of guest for the backdoor guest account
CVE-2015-2882 Philips In.Sight B120/37 has a password of b120root for the backdoor root account, a password of/ADMIN/for
the backdoor admin account, a password of merlin for the backdoor mg3500 account, a password of M100-4674448 for the
backdoor user account, and a password of M100-4674448 for the backdoor admin account
CVE-2015-2881 Gynoii has a password of guest for the backdoor guest account and a password of 12345 for the backdoor admin
account
CVE-2017-5674 A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP
camera models allows an attacker to craft a malformed HTTP (‘‘GET system.ini HTTP/1.1\n\n’’—note the lack of ‘‘/’’ in the
path field of the request) request that will disclose the configuration file with the login password
CVE-2016-6890 Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a
crafted Subject Alt Name in an X.509 certificate
8.8 high CVE-2017-7911 A Code Injection issue was discovered in CyberVision Kaa IoT Platform, Version 0.7.4. An insufficient-
encapsulation vulnerability has been identified, which may allow remote code execution
CVE-2017-8403 360fly 4 K cameras allow unauthenticated Wi-Fi password changes and complete access with REST by using
the Bluetooth Low Energy pairing procedure, which is available at any time and does not require a password. This affects
firmware 2.1.4. Exploitation can use the 360fly Android or iOS application, or the BlueZ gatttool program
CVE-2015-2889 Summer Baby Zoom Wifi Monitor & Internet Viewing System allows remote attackers to gain privileges via
manual entry of a Settings URL
CVE-2015-2880 TRENDnet WiFi Baby Cam TV-IP743SIC has a password of admin for the backdoor root account
CVE-2017-5675 A command-injection vulnerability exists in a web application on a custom-built GoAhead web server used on
Foscam, Vstarcam, and multiple white-label IP camera models. The mail-sending form in the mail.htm page allows an attacker
to inject a command into the receiver1 field in the form; it will be executed with root privileges
8.1 high CVE-2017-14743 Faleemi FSC-880 00.01.01.0048P2 devices allow unauthenticated SQL injection via the Username element in
an XML document to/onvif/device_service, as demonstrated by reading the admin password
7.8 high CVE-2017-0861 Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows
attackers to gain privileges via unspecified vectors
7.5 high CVE-2017-11498 Buffer overflow in hasplms in Gemalto ACC (Admin Control Center), all versions ranging from HASP SRM
2.10 to Sentinel LDK 7.50, allows remote attackers to shut down the remote process (a denial of service) via a language pack
(ZIP file) with invalid HTML files
CVE-2017-6780 A vulnerability in the TCP throttling process for Cisco IoT Field Network Director (IoT-FND) could allow an
unauthenticated, remote attacker to cause the system to consume additional memory, eventually forcing the device to restart,
aka Memory Exhaustion. The vulnerability is due to insufficient rate-limiting protection. An attacker could exploit this
vulnerability by sending a high rate of TCP packets to a specific group of open listening ports on a targeted device. An exploit
could allow the attacker to cause the system to consume additional memory. If enough available memory is consumed, the
system will restart, creating a temporary denial of service (DoS) condition. The DoS condition will end after the device has
finished the restart process. This vulnerability affects the following Cisco products: Connected Grid Network Management
System, if running a software release prior to IoT-FND Release 4.0; IoT Field Network Director, if running a software release
prior to IoT-FND Release 4.0. Cisco Bug IDs: CSCvc77164

123
 Cluster Computing

Table 2 (continued)
CVSS Vulnerability ID and its summary
severity

CVE-2017-7730 iSmartAlarm cube devices allow Denial of Service. Sending a SYN flood on port 12345 will freeze the ‘‘cube’’
and it will stop responding
CVE-2017-7729 On iSmartAlarm cube devices, there is Incorrect Access Control because a ‘‘new key’’ is transmitted in cleartext
CVE-2017-7726 iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability
CVE-2017-3214 The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary
CVE-2015-2886 iBaby M6 allows remote attackers to obtain sensitive information, related to the ibabycloud.com service
CVE-2015-2884 Philips In.Sight B120/37 allows remote attackers to obtain sensitive information via a direct request, related to
yoics.net URLs, stream.m3u8 URIs, and cam_service_enable.cgi
CVE-2017-7243 Eclipse tinydtls 0.8.2 for Eclipse IoT allows remote attackers to cause a DoS (DTLS peer crash) by sending a
‘‘Change cipher spec’’ packet without pre-handshake
CVE-2017-6318 saned in sane-backends 1.0.25 allows remote attackers to obtain sensitive memory information via a crafted
SANE_NET_CONTROL_OPTION packet
CVE-2016-10109 Use-after-free vulnerability in pcsc-lite before 1.8.20 allows a remote attackers to cause DoS (crash) via a
command that uses ‘‘cardsList’’ after the handle has been released through the SCardReleaseContext function
CVE-2016-6892 The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a DoS (free of
unallocated memory) via a crafted X.509 certificate
CVE-2016-6891 MatrixSSL before 3.8.6 allows remote attackers to cause a DoS (out-of-bounds read) via a crafted ASN.1 Bit
Field primitive in an X.509 certificate
5.4 medium CVE-2015-2883 Philips In.Sight B120/37 has XSS, related to the Weaved cloud web service, as demonstrated by the name
parameter to deviceSettings.php or shareDevice.php
5.3 medium CVE-2017-3215 The Milwaukee ONE-KEY Android mobile application uses bearer tokens with an expiration of 1 year. This
bearer token, in combination with a user_id can be used to perform user actions

encrypted, a compromised-key attack can occur, where the other major websites by infecting numerous IoT devices
key to encrypted communications is stolen and then used to (primarily older routers and IP cameras), running out-of-
decrypt it. date versions of the Linux kernel, and then used them to
In addition, data flow can be disrupted by DoS attacks, flood DNS provider Dyn with a DDoS attack. Another
where malicious actors prevent or slow down the use of botnet—Brickerbot—simply killed the IoT devices.
certain networks and/or devices. Here it is one simple Simple hiding of traditional malware in the big volume
example. A DNS amplification DDoS attack only requires of IoT data is also very feasible.
smart devices to send a spoofed 64 byte query to an open Because of their specific vulnerabilities, some smart
DNS resolver, which will result in a 3223 byte response. devices can illegally conduct unauthorized reconnaissance
This amplifies 50 times whatever bandwidth can be mus- of, and spying on, neighbors and neighboring properties by
tered. By exploiting a large number of smart devices, this recording or observing footage from IP cameras, listening
could result in a DDoS attack of significant magnitude. via audio devices (e.g., microphones in TVs or games
The second case essentially differs from the first one in consoles), or using Bluetooth or wireless communication
that it does not use amplification techniques; instead, it channels to identify the presence or status of neighboring
relies on a botnet of compromised devices, called ‘‘thing- devices. One of the examples is the TRENDnet’s Web
bots’’ (like the Spike DDoS botnet toolkit [30] and the camera exploit, mentioned in [32]. On March 7, 2017
Carna embedded-device botnet [31]). Most smart devices WikiLeaks began a new series of leaks (https://wikileaks.
with limited computing capabilities are useful as bots in the org/ciav7p1). The first part of the series, called ‘‘Year
botnets. In September 2016, a series of potent DDoS Zero’’, introduced a malware arsenal and dozens of ‘‘zero
attacks, which used IoT malware to infect and leverage a day’’ weaponized exploits against a wide range of U.S. and
large number of Internet-connected devices, hit several European company products (e.g., Apple’s iPhone, Goo-
companies [31]. They typically got infected because their gle’s Android, Microsoft’s Windows, Samsung TVs),
users maintained insecure default configurations and which can be turned into covert microphones.
accounts and did not have anti-malware solutions. For The impersonation of genuine actors to inject falsified
example, the Mirai botnet took down Etsy, GitHub, Netflix, data (e.g., signal injection) in order to cause damage or
Shopify, SoundCloud, Spotify, Twitter, and a number of disruption in the IoT is also possible. For example,

123
Cluster Computing

masquerading as a genuine CO2 sensor or thermostat to development stage to ensure their reliable and resilient
send false data to the fire detection or heating management functioning. The IoT devices’ and applications’ security
and control system would result in the fire or temperature should not be an add-on and must be addressed beginning
alarm being triggered. with their initial design and continuing through the oper-
MitM attacks, where a third entity captures authentica- ational environment; it has to be built into devices and
tion credentials (steals the data) being transmitted between applications so that they are ‘‘secure by design’’ [34]. This
two parties and/or devices and then hijacks open sessions, approach seeks to make systems as free of vulnerabilities
are also relevant for the IoT. Whether sensitive data is in and impervious to attack as possible through measures such
transit over the physical (e.g., Ethernet, Wi-Fi or 802.15.4), as continuous testing, authentication safeguards and
network (e.g., IP, Modbus or OPC-UA) or application (e.g., adherence to best practices. (By the way, the same
MQTT, CoAP or web sockets) layer, non-secure commu- approach should be extended to the design of the entire
nication channels can be vulnerable to this attack. In turn, IoT.)
the IoT devices can be vulnerable to hijacking due to a A quick glance at Fig. 1 leads to the conclusion that the
stack buffer overflow because of insufficient input valida- IoT systems are highly complex and hence require end-to-
tion [33]. end IS approaches that span all the layers, whereas the
Summing up all these and many other facts, we propose resource-constrained IoT devices are often not powerful
our taxonomy of network attacks against the IoT (Table 3) enough to support traditional security solutions. Simplify-
[2]. This table describes their variety according to the ing this challenge, it can be said that the IoT IS can be
types, affected IoT objects, damage, detection complexity, considered the area of endeavor that is concerned with
implementation level, methods and tools used, probability protecting connected devices and networks, which are
of recurrence, etc. The given classification does not pretend critical to the operation of the IoT. A multi-layered
to completeness and can be used as a framework for any approach for ensuring the IoT’s comprehensive IS must
extension as many new attacks are predicted for the coming start at the very beginning when powered on, a trusted
years. computing baseline is being established, and the whole
The data from Table 3 can be used to construct an IS trusted IoT begins to operate. But even with this simplifi-
threat model and an IS risk assessment for the IoT, its cation it is obvious that the older security programs are no
separate parts, or even smart devices. We define the IS longer adequate.
threat model as a formalized description of the following The older well-established existing IPTs cannot control,
characteristics: or control very weakly, the IoT devices, Bluetooth, or their
critical IoT device protocols. Figure 2 [35] shows the
• IS threat sources (anthropogenic, technogenic,
evolution of IPTs. IPTs that have been designed first for
environmental);
LANs and then modified for Intranets cannot be highly
• Vulnerabilities they exploit;
effective for the IoT. The main reason is that the IoT is a
• Objects suitable for threat’s realization (here these
revolution in comparison to the Internet, but not an evo-
objects are data stores, data flows or data processes
lution like LANs and Intranets. We cannot simply adapt
(like processing, analytics, management), IoT devices
old IPTs to the unique constraints of embedded IoT devi-
and external entities interacting with the IoT);
ces. While firewalls and network protocols can be adapted
• Threat’s implementation techniques (actual attacks);
to the IoT challenges and can still manage high-level IoT
• Types of possible loss; extent of the potential damage;
traffic, how can deeply embedded end-point devices be
• Some additional information such as likelihood of
protected, considering they have very specific objectives
threats implementation; and
and limited resources to accomplish them?
• Destructive impact (including interconnecting); dam-
For the IoT, we suggest dividing all modern IS coun-
age elimination/limitation; impact frequency and dura-
termeasures for ensuring overall robust security (so called
tion, etc.
security controls refers to measures that modify IS risks
and include any process, policy, device, practice, or other
actions which modify IS risk [36]) into two groups:
6 Key directions of ensuring information
(1) Generic, which are independent of applications and
security for the IoT
include obligatorily authentication and authorization
as well as:
From Table 1 and Fig. 1 it is easy to determine that the key
IoT objects to be protected are data, devices (hardware) a. At the application layer: application data confi-
and their communications, applications, clouds, and their dentiality and integrity protection, privacy pro-
lifecycle management. In addition, IS must be started in the tection, IS audit and anti-virus;

123
 Cluster Computing

Table 3 Taxonomy of network attacks against the IoT (fragment)

Classification Parameter content
parameters

Affected IoT assets IoT infrastructure and its separate elements (sensor, device, gateway, channel, subnetwork, etc.), account,
information, IPT, service delivery, business/management/technological process, database management system,
operating system, file, etc.
Affected information General and special purpose control and management information, billing information, Personally Identifiable
Information (PII), service information, reference information, operating and telecommunication environment
information, etc.
Aim—Violation of Physical integrity—destruction (distortion) (e.g., medical device disruption)
Logical structure—distortion of the structure (e.g., insertion of spying device)
Content—unauthorized modification (e.g., spamming, fake updates for device)
Confidentiality—unauthorized obtaining (e.g. IP camera’s compromise, SmartMeter spying, room mapping)
Property rights—misappropriation of rights
Availability—disconnection, destruction (e.g., remote control car, DDoS)
Privacy (PII theft)
Damage Physical harm to people, prolonged downtime, damage to equipment, software and hardware failures, resource theft,
IS policies breach, etc.
Damage severity Minimum, medium, high or critical
Type Accomplished (duration fixed), in progress (start time), attempt, suspected
Origin nature: malicious or accidental
Realized by… People, software, hardware, process, data, etc.
Malefactors Criminal, user, administrator, manager, developer, etc.
Motivation Enrichment, revenge, vengeance, sabotage, industrial espionage, self-assertion, vandalism, extortion, hacktivism, etc.
Attack started… From the Internet, cloud, mobile device, etc.
Start conditions On request from a victim (e.g., MitM)
On a particular event (e.g., replay attack, spoofing)
Unconditionally (e.g., sniffing, phishing, flooding)
OSI/ISO implementation Physical (e.g., lock picking, hardware modification, wiretapping, replacement, node tempering, malicious node
level injection)
Data link (e.g., ARP cache poisoning, DHCP starvation, MAC modification, wireless client de-authentication)
Network (e.g., sniffing, spoofing, ICMP flooding, Sinkhole, Wormhole and Blackhole attacks, Route cache poisoning,
cloning)
Transport (e.g., spoofing, Smurf, session hijacking, TCP port scan, TCP host sweeps, UDP flooding)
Session, presentation & application (e.g., flooding, viruses, MiTM, repudiation, buffer overflow, DDoS, phising, side
channel attack, cryptanalysis attack)
Combined (e.g., DDoS, jamming)
Method/Actions Scanning & probing, masquerading, counterfeiting, modification, copying, deleting, sniffing, flooding, spoofing,
MiTM, pharming, spamming, phishing, etc.
Tools Information interchange, social engineering, hardware, user’s commands, software (including toolkits/rootkits,
scripts), viruses, worms, anonymizing proxy usage, etc.
Vulnerability(-ies) used Lack of IS knowledge, poor IS policies, IS policies violation by people, lack of IPTs, their bad configuration, etc.
Influence type Passive (e.g., sniffing/eavesdropping)
Active (DoS, spoofing, MitM, flooding, etc.)
Victim-Attacker In one network segment (e.g., sniffing, spoofing)
allocation In different network segments (e.g., DoS, MitM, flooding)
Number of victims/ Traditional—one attacker to one/many victims
attackers Distributed—many attackers to one/many victims (usage of thingbots)
Feedback with a victim With a feedback (e.g., spoofing, MitM)
Without a feedback (e.g., sniffing)
IPTs disruption None, failure, unavailability of critical information to perform functions, violation of IPT’s software/hardware
integrity, IPT’s settings change, etc.

123
Cluster Computing

Table 3 (continued)
Classification Parameter content
parameters

Detection complexity Normal or high

Probability of recurrence Minimum, medium, high or critical

Fig. 2 IPTs evolution, where IDS intrusion detection system, SPI Anti-DDos anti distributed denial-of-service, UTM unified threat
stateful packet inspection, DPI deep packet inspection, OC outbound management, URL uniform resource locator, FW firewall, NG next-
control, FCI full content inspection, IPS intrusion prevention system, generation, DLP data loss prevention, SWG secure web gateway

b. At the network layer: user data and signalling ease of use, requires traditionally both encryption and
data confidentiality and signalling integrity authentication for devices and users to check whether
protection; or not they can trust a remote system.
c. At the device layer: device integrity validation, New technologies (such as elliptic curve and
access control, data confidentiality and integrity lightweight cryptography) can be used to solve the
protection; first task. Applying additional cryptographic best
practices to the IoT communications includes, for
(2) Specific, which are closely coupled with application-
example, encrypting configuration communications by
specific requirements (e.g., mobile payment) and out
default and encrypting local storage of sensitive data,
of this paper’s scope.
and authenticating communications, software changes
Based on our analysis of above related work, in partic- and requests for data, etc. Here we would like to give
ular [17–26], we add to the three IoT tiers of IoT (per- as an example the oauth2.0 authentication protocol,
ception, network and application) issues of prevailing providing specific authorization flows for IoT devices
directions of ensuring IS for the IoT: (like living room devices and mobile phones), web and
desktop applications and so on.
• Secure IoT architecture, design and everyday manage-
The second task solution is of high priority as more
ment using proven and recognized security practices;
devices join the IoT. Identity and authentication are the
and
front line for IoT IS. Old mandatory and role-based
• More general hardware (IoT back-end, edge devices,
access controls, which are built into operating systems
sensor, gateways, etc.) security, including identifica-
and access only strictly necessary resources, limit the
tion, authentication, access control, trust, and commu-
privileges of devices and applications and so do not
nication policies and protocols.
solve the problem. Device-based controls are analo-
Thus, from this viewpoint the following key IoT pro- gous to network-based systems (such as microsoft
tection directions can be highlighted, requiring the close active directory). The least privilege principle means
coupling of hardware and software solutions, as well as that only the minimal access required to perform a
strong IS policies for IoT users (so-called organizational IS function is authorized and if someone manages to steal
policies) and the IoT devices’ configuration and manage- the access credentials, compromised information
ment (so-called technical IS policies). would be limited to only those IoT areas that are
authorized by those particular credentials [27]. The
1. Supporting the IoT protocols and hardware connec-
newest access control systems with well-established
tivity methods, as well as protecting the IoT software-
supporting processes authenticate both the devices and
supported connectivity and communications, besides
the users behind them (or deeply embedded devices
centralizing management to increase IS and improve

123
 Cluster Computing

more often than not), and authorize those users and An independent technical solution (e.g., scanning
devices for specific actions prior to receiving or the bar code by mobile phone, getting a code
transmitting data. The process bases are identifica- through RFID, etc.) can be used for its testing;
tion-discovery-inventorying of new IoT devices and • Devices should use strong authentication by default
their integration into a broader management to clearly (e.g., passwords) and not use common or easily
demark and establish areas of accountability and guessable user names/passwords (e.g., admin,
responsibility for keeping devices protected [37]. It is passwd);
also reasonable to use unique credentials for each • Devices should be restrictive rather than permissive
network device that can be updated, to utilize encryp- in communicating and whenever possible they
tion for these devices, to constantly monitor all wired should not be reachable via inbound connections by
and wireless connections, to secure communications to default [39];
and from IoT controllers and gateways, and in • Devices should not rely on the network firewall
particular to use the transport layer security (TLS) alone to restrict communication, as some commu-
protocol to secure communications themselves, etc. nications between devices within the home may not
Here we would like to add other applicable secure traverse it [40]. Because of this, all security
protocols like secure file transfer protocol (SFTP) that features on smart devices should be enabled. IoT
provides file access, transfer and management over devices and sensors should analyze data to make
data streams, HTTP secure (HTTPS) that provides autonomous or semi-autonomous IS decisions at
secure communication over the IoT, web distributed the edge as the high volume of data that comes
authoring and versioning (WebDAV), that allows from them will quickly overwhelm networks (they
clients to perform remote Web content authoring should send that data only occasionally to the cloud
operations, and others. for further analysis);
To that picture we would like to add the controlled • Devices should continue to function if Internet
use of IPv6 in the IoT and support of all connections’ connectivity is disrupted and the cloud back-end
visibility, which are among the most urgent security fails (e.g., a light switch or a thermostat should
needs. continue to function with manual controls) [39];
2. All IoT assets (including hardware, software and all • Devices should have a reset mechanism that clears
types of sensitive data to be protected) should be the current configuration, and have a range of
securely accessed regardless of location. Their visi- possible configurations to allow a user to customize
bility should be provided. In addition to physical the behavior of the device [39];
security, protecting the IoT devices requires both • The default username and password should be
cryptographic code signing by the application and required to be changed after the installation of any
firmware levels (to be sure it is authorized to run), and IoT device;
configuring the devices to run only the signed code (to • Passwords for IoT devices should be unique per
be sure that it was not overwritten after its loading). device, especially when they are connected to the
Host-based protection, still working long after code Internet;
begins running and providing logging, blocking, • All unused ports should be closed and all unnec-
whitelisting, sandboxing, intrusion prevention, behav- essary services should be disabled on all devices
ioral- and reputation-based analysis, etc., can help (including IoT routers, etc.); and
here. In addition, the most secure IoT devices have • IoT devices should be always updated with the
embedded operating systems with software security latest software and firmware updates, etc.
controls that are introduced at the operating system An important issue to be solved here is to compose
level and take advantage of hardware security capa- large number of access control policies for different
bilities [27]. IoT resources; any conflicts should be eliminated.
Other important recommendations for the IoT
3. The IoT devices’ software authenticity and integrity
devices are the following:
should be verified for secure booting, when powered
• To combat counterfeiting, each device may have a on [27]. Cryptographically generated digital signatures
unique identifier (using the digital object architec- can be used for this, as they ensure that the device will
ture (DOA) concept [38]), which any purchaser of load only signed software that is authorized to run on
ICT products will be familiar with. Their identifi- that device.
cation should be based on secure procedures to 4. The firmware of smart devices should always be kept
ensure IoT systems’ privacy and trustworthiness. updated. Once the IoT device is in operation, different

123
Cluster Computing

vulnerabilities may be discovered. All vulnerabilities and operations technologies (OT) is also an important
should be patched as soon as they are announced. requirement.
Thus, IoT devices will need to be patched via 9. We must mention here the mandatory use of special-
automated and secure IoT device management. Not ized cloud-based security services as the cloud is an
to do this physically (visiting in person each device for integral part of the IoT.
updates), over-the air (OTA) manageability [40] must 10. Strict least-privilege human access controls to all IoT
be built into these devices at the time of production so resources is mandatory. To eliminate human tempta-
they can receive and install software updates and tion to access them, access controls should be properly
security patches after their authentication, which implemented, monitored and enforced.
eliminates the possibility of compromising their func- 11. The next countermeasures are the organizational IS
tional safety. Another task is to support delivery in a policies. These are more studied and elaborated than
way that conserves the limited bandwidth and inter- all that was described above, because the human factor
mittent connectivity of the embedded device. is fundamental in any network environment such as the
5. As a very important IoT component, the data centers Internet or the IoT (we do not want to discuss that in
should be always protected by all appropriate means this more technically directed paper, and only note that
and scale up/down according to their usage. it has long been believed that 80% of IS incidents are
6. IoT transport integrity should be supported and all related to human factors and only 20 of them to
network traffic in the IoT should be permanently technical causes). In this regard, the most important in
inspected, logged and treated ‘‘at wire speed’’ as our opinion recommendations are the following (the
threat traffic until it is verified that this traffic is listed documents should of course reflect exactly the
authorized, inspected and secured. To control incom- IoT specifics):
ing traffic at the IoT device, a deep packet inspection
• To create the acceptable use policy that regulates
(DPI) capability is needed; this capability exists in
and controls what people can and cannot do with
modern host-based next-generation FireWalls
the IoT devices, communication channels and
(NGFW), often with next-generation intrusion protec-
workstations connected to the IoT;
tion systems (NGIPS) inside, and in network-based
• To create remote access, wireless communication,
appliances in place [27]. The reason is that very often
Bluetooth requirements, IoT router and switch
the IoT devices have their own unique protocols,
policies;
distinct from the enterprise’s protocols, and the devices
• To create IoT security awareness procedures and
need to filter the specific incoming data, distinct from
password construction guidelines for secure pass-
higher-level, common Internet traffic, with the limited
words in the IoT;
computational resources available. They also must
• To create data governance, server security, and
gain network traffic visibility and verify that all IoT
application security policies;
resources and users are indeed doing the right things.
• To create an acceptable encryption policy and
7. To enhance overall IS, new technologies such as
policies for IPTs used in the IoT;
software-defined networking (SDN) can be used to
• To create disaster recovery and IS incident
virtualize, package, and target each IoT device with its
response plans, IS level and IS risk assessment
own security profile (as we mentioned earlier the
methods, and an IS risk management policy;
technical IS policies, which in a dynamic IoT can be
• To develop clear responsibilities for everything
automatically designed and evolved) and end-to-end
related to the IoT; and
service management processes. This interesting idea
• To have a compliance process for all IS policies
was proposed in [41]. Its continuation is a quick
used.
identification of network paths, where a breach is
detected, and protection of network links between the 12. Everything mentioned above should be augmented by
SDN controller and IoT devices using centralized advanced detection capabilities and sharing threat
programmable control capabilities. intelligence for IoT (both inside the organization and
8. Like for traditional networks, an approach with among organizations) and collaboration in real-time IS
adequate internal segmentation of the IoT is paramount incident detection, isolation and response, driving
for monitoring and protecting distributed computing enhanced decision-making capabilities. Only those
and for enforcing and coordinating distributed security detection systems and controls that understand specific
for such a complicated system as the IoT. Segmenta- IoT protocols should be deployed, for example Indus-
tion between the IoT, information technologies (IT), trial Control System (ICS) protocols. Constant review-
ing of the environment for new threats and

123
 Cluster Computing

vulnerabilities should be implemented. Whitebox and systematically analyzing it for quicker understanding of a
blackbox security penetration testing specific to the IoT current situation with the IoT security give rise to well-
devices should be carried out periodically. known problems of big data and security intelligence (SI).
13. And last (but not least): IoT security is broader than Since 2010, there has been no well-established and
IS; it requires addressing things like physical safety, recognized definition of SI. We use the following: SI is
business continuity, and disaster recovery. As the IoT real-time collection, normalization and analysis of the data
has the potential for great growth, the approach to generated by users, applications and infrastructure that
secure it needs to scale dynamically. It requires impacts the IT security and risk posture [43]. Viewing
thinking in terms broader than IS. It is time to talk time-stamped historical data or logs is very important for
about a more general concept, operational resilience. It IS incident investigation, but stopping ongoing incidents is
refers to the ability of the system to adjust its possible in only one case—when there is a real-time up-to-
functioning to sustain operations during expected the-second view in a concrete context of what is happening
conditions and in the face of escalating demands, right now, enabling the analysts to find unusual events and
disturbances and unforeseen circumstances [42]. Thus, to flag anomalies that might be suspicious or dangerous,
operational resilience includes IS as an integral part, malicious or not, across the entire IoT. Any delay, and only
and the IoT operational resilience is the area of our reactive actions to IS incidents, puts the IoT at risk.
future deep investigation. Summarizing [43–46], the following key advantages of
SI can be listed:
It is important to note that only an integrated approach
to the simultaneous implementation of all these controls • 2497 security coverage, combining local monitoring
will ensure IoT security. In none of the analyzed works on observations, external SI and internal threat intelli-
the IoT security topic have we found this very simple and gence, and continuously recorded history in one place
powerful idea. It can be brought to life on the basis of a without requiring full-time staffing;
unified IoT security policy, supported by the security • A holistic approach with defense-in-depth (castle)
intelligence approach. strategies, meaning that an organization looks at every
aspect of its IS threat management in relation to every
other aspect, and views IS as more than a matter of
7 Security intelligence for ensuring mitigating IS risk;
information security for the IoT • Proactive and predictive monitoring of IS threats, based
on predefined meaningful IS metrics for making faster,
Modern analytics adds great value to the IoT technologies. more-informed, smarter decisions through real-time
Collecting, storing and analyzing data from industrial integration;
sensors and various IoT devices has become more feasible • Alignment of IS risk ranking and management with
because of the advances in big data IT. For securing the business needs, based on a business impact analysis;
IoT, it is also true: volumes and heterogeneity of data • Built-in IS risk framework, vulnerability assessment,
circulating in the IoT and related activity requires big data patch management, audit, etc. functions;
analytics for further scrupulous monitoring and analysis are • Better understanding of an organization’s overall
very high. exposure supported by cross-channel visibility in a
From the IS viewpoint, IS-related data circulating in the single view with comprehensive reporting dashboards
IoT can be in four types of silos: data collected from the and entity link analysis to reveal hidden relationships
IoT devices, applications, etc.; data in the IoT data streams and suspicious associations among users, accounts, and
(network traffic consisting from network packets); data other entities early in their life cycles;
segregated by the IoT users; and data locked up in disparate • Advanced context-based analytics, meaning the ability
security devices, applications and databases (IPTs). Each to automatically correlate observed applications, hosts
of these silos creates enormous volumes of data in different and users activity, their geo-location, network traffic
formats, for different purposes, and often with different IS telemetry, white/black listing, events, etc. with system,
policies and even compliance requirements. One problem application, network, server, IPT and other logs to
is how to structure, consolidate, and visually present all detect patterns and trends in a consistent way;
these silos to aid IoT IS management to make timely and • Behavioral-based cross-correlation that triggers priority
informed decisions. Ever-increasing volumes of data on IS alerts and automated responses based on IS risk scores
events, IoT elements’ vulnerabilities, users, IS threats and tied to specific services and combinations of events or
related information, and the need for more rapidly thresholds of changes in these indicators;
obtaining ‘‘raw’’ heterogeneous information,

123
Cluster Computing

Fig. 3 Security intelligence

usage for the IoT IS ensuring

• Baseline-driven anomaly detection based on atypical the IoT IS-related knowledge-discovery process is neces-
actions; and sary for visualization in order to detect IS incidents and
• Increasing efficiency (in terms of reducing costs and threats, to respond to them and predict possible IS risks for
complexity of IS incident response and improving the IoT.
attack detection accuracy by instantly understanding
the entire attack kill chain) via launching a unified
defense against IS threats based on a centralized case 8 Conclusion
management, a common repository for cross-channel
data; etc. Let us sum up. A comprehensive study of IS issues for the
IoT is extremely important in relation to its increasing
The proposed SI application for the IoT ensuring IS is
spread. We believe that our analysis generalizes the related
illustrated by Fig. 3. Data cleaning/cleansing removes
work on the topic and shows the variety and complexity of
noise and irrelevant and inconsistent data from the col-
vulnerabilities and attacks against it. That requires the
lection gathered from various kinds of interconnected and
development of new security approaches and tools, because
autonomous sources. Data integration combines data from
the old cannot cope with the more complex modern and
multiple and heterogeneous sources. Relevant to the anal-
specific tasks for the IoT. With this research, we confirmed
ysis task, data selection provides a reduced representation
that IS is now an essential consideration for anyone making
of the data set to keep the integrity of the original data set
or operating IoT devices or systems, particularly for the
in a reduced volume. During data transformation the
industrial Internet. In contrast to the content provided by
selected data are transformed or consolidated into suit-
other authors, we followed the methodology, which in our
able formats appropriate for mining. After these stages of
opinion is favorably distinguished from its numerous ana-
preprocessing, mining data streams involves the efficient
logues: view of the IoT as a security object to be protected,
discovery of general patterns and dynamic changes within
leading to understanding its vulnerabilities and possible
the IoT stream data. Intelligent analysis methods and tools
attacks against the IoT exploiting these vulnerabilities, and
discover and extract potentially useful data patterns. In the
from there approaches to protecting the IoT.
case of IoT IS-related data, multilevel stream processing,
We are going to use the results obtained in creating the
multidimensional on-line analysis, and mining are per-
model of the operationally resilient IoT in the framework
formed on stream data. The security analysts are interested
of the recently established (in 2016) NRNU MEPhI’s
in higher and multiple levels of abstraction to predict or
Strategic Academic Unit called the Institute of Cyber
detect IS events in the IoT. Pattern evaluation identifies the
Intelligence Systems (ICIS), the ‘‘Network Security Intel-
truly interesting and useful patterns, using given validation
ligence Center’’ (NSIC) educational and research center for
measures. Knowledge representation as the final phase of
intelligent network security management [47]. The NSIC’s

123
 Cluster Computing

project relevance is determined by the urgent need to create 16. Shancang, L., Da Xu, L.: Securing the Internet of Things. Else-
a scientific, methodical and material base for network vier, Amsterdam (2017)
17. Schneier, B.: IoT security: what’s plan B? IEEE Secur. Priv.
security professional training through the use of modern 15(5), 96 (2017)
and advanced ICT and educational technologies. 18. Dayaker, P., Madan Reddy, Y., Bhargav Kumar, M.: A survey on
Another very fruitful research area is the application of applications and security issues of internet of things. Int. J. Mech.
blockchain technology [48] to supply and access IoT data Eng. Technol. 8(6), 641–648 (2017)
19. Kiran, P.S., Babu, E.S., Padmini, D., SriLalitha, V.S., Krish-
without the need for central control and management that nanand, V.: Security issues and countermeasures of three tier
creates completely new tasks to ensure the security of this architecture of IOT—a survey. Int. J. Pure Appl. Math. 115(6),
data. 49–57 (2017)
The third interesting direction is to investigate how IPv6 20. Razzaq, M.A., Qureshi, M.A., Gill, S.H., Ullah, S.: Security
issues in the Internet of Things (IoT): a comprehensive study. Int.
deployment will affect the IoT security as most IoT devices J. Adv. Comput. Sci. Appl. 8(6), 383–388 (2017)
operate under two different sets of protocols—one set of 21. Sasikala, B., Rajanarajana, M., Geethavani, B.: Internet of
proprietary protocols on the local network and another set Things: a survey on security issues analysis and counter mea-
of wide-spread protocols across the Internet. sures. Int. J. Eng. Comput. Sci. 6(5), 21435–21442 (2017)
22. Pawar, A.B., Ghumbre, S: A survey on IoT applications, security
challenges and counter measures. In: International Conference on
Computing, Analytics and Security Trends, CAST 2016,
pp. 294–299 (2017)
References 23. Ben Ida, I., Jemai, A., Loukil, A.: A survey on security of IoT in
the context of eHealth and clouds. In: International Design and
1. Neustar Cybersecurity Essentials for 2017: http://docs.media.bit Test Workshop, pp. 25–30 (2017)
pipe.com/io_13x/io_134791/item_1489337/ddos-cyber-security- 24. Deogirikar, J., Vidhate, A.: Security attacks in IoT: a survey. In:
insights-2016.pdf (2016). Accessed 7 Jan 2018 Proceedings of the International Conference on IoT in Social,
2. Malyuk, A., Miloslavskaya, N: Information security theory for Mobile, Analytics and Cloud, I-SMAC 2017, pp. 32–37 (2017)
the future internet. In: Proceedings of the 3rd International 25. Minoli, D., Sohraby, K., Kouns, J.: IoT security (IoTSec) con-
Conference ‘‘Future Internet of Things and Cloud’’ (FiCloud siderations, requirements, and architecture. In: 2017 14th IEEE
2015). Rome, 24–26 August 2015, pp. 150–157 (2015) Annual Consumer Communications & Networking Conference
3. Recommendations ITU-T Y.4000/Y.2060 (06/2012) (CCNC), IEEE Proceedings, pp. 1006–1007 (2017)
4. Internet of Things (IoT): http://internetofthingsagenda.techtarget. 26. Radovan, M., Golub, B.: Trends in IoT security. In: 2017 40th
com/definition/Internet-of-Things-IoT (2016). Accessed 7 Jan International Convention on Information and Communication
2018 Technology, Electronics and Microelectronics (MIPRO), IEEE
5. Miloslavskaya, N., Tolstoy, A.: State-level views on professional Proceedings, pp. 1302–1308 (2017)
competencies in the field of IoT and cloud information security. 27. Security in the Internet of Things: Lessons from the Past for the
In: Proceedings of 2016 4th International Conference on Future Connected Future. https://www.windriver.com/whitepapers/
Internet of Things and Cloud Workshops. The 3rd International security-in-the-internet-of-things/wr_security-in-the-internet-of-
Symposium on Intercloud and IoT. Vienna, August 2016, things.pdf (2015). Accessed 7 Jan 2018
pp. 83–90 (2016) 28. Lucian, C: Hackers found 47 new vulnerabilities in 23 IoT
6. Pfister, C.: Getting Started with the Internet of Things: Con- devices at DEF CON. http://www.csoonline.com/article/
necting Sensors and Microcontrollers to the Cloud. O’Reily, 3119765/security/hackers-found-47-new-vulnerabilities-in-23-
Sebastopol (2011) iot-devices-at-def-con.html (2017). Accessed 7 Jan 2018
7. McEwen, A., Cassimally, H.: Designing the Internet of Things. 29. E-Guide: The biggest security challenges for embedded and
Wiley, Hokoben (2014) mobile development amid the rise of IoT. E-Guide. http://docs.
8. Behga, A., Madisetti, V.: Internet of Things (A Hands-on media.bitpipe.com/io_12x/io_129893/item_1326785/Pro
Approach). VPT, Blacksburg, VA (2014) grammingResearch_IoTAgenda_IO%23129893_Eguide_
9. Holler, J., Tsiatsis, V., Mulligan, C., Avesand, S., Karnouskos, S., 042016_LI%231326785.pdf. Accessed 7 Jan 2018
Boyle, D.: From Machine-to-Machine to the Internet of Things: 30. Akamai Technologies: Spike DDOS toolkit. https://www.akamai.
Introduction to a New Age of Intelligence. Elsevier, Amsterdam com/us/en/multimedia/documents/state-of-the-internet/spike-
(2014) ddos-toolkit-threat-advisory.pdf (2014). Accessed 7 Jan 2018
10. Greengard, S.: The Internet of Things. The MIT Press Essential 31. Wright, R: Powerful DDoS attacks leveraging IoT devices hit
Knowledge Series, Cambridge (2015) several companies. http://searchsecurity.techtarget.com/news/
11. Kurniawan, A.: Smart Internet of Things. Packt Publishing Ltd, 450305010/Powerful-DDoS-attacks-leveraging-IoT-devices-hit-
Birmingham (2016) several-companies (2016). Accessed 7 Jan 2018
12. Keele, S.: Guidelines for performing systematic literature reviews 32. Wallen, J.: Five nightmarish attacks that show the risks of IoT
in software engineering. Technical Report, EBSE Technical security. http://www.zdnet.com/article/5-nightmarish-attacks-
Report EBSE-2007-01 (2007) that-show-the-risks-of-iot-security/ (2017). Accessed 7 Jan 2018
13. Dhanjani, N.: Abusing the Internet of Things: Blackouts, Freak- 33. Osborne, C.: NetUSB flaw leaves ‘millions’ of routers, IoT
outs, and Stakeouts. O’Reilly Media, Sebastopol (2015) devices vulnerable to hacking. http://www.zdnet.com/article/
14. Russell, B., Van Duren, D.: Practical Internet of Things Security. netusb-flaw-leaves-millions-of-routers-iot-devices-vulnerable-to-
Packt Publishing, Birmingham (2016) hacking/ (2015). Accessed 7 Jan 2018
15. Hu, F.: Security and Privacy in Internet of Things: Models, 34. Security by design: http://whatis.techtarget.com/definition/secur
Algorithms, and Implementations. CRC Press, Boca Raton (2016) ity-by-design (2015). Accessed 7 Jan 2018

123
Cluster Computing

35. Conrad, C.: Next generation security. Slideshow. https://www. Natalia Miloslavskaya after
slideshare.net/neoma329/next-generationsecurity (2013). Acces- graduating NRNU MEPhI
sed 7 Jan 2018 works at MEPhI. She was a
36. ISO/IEC 27000:2016: Information technology—security tech- Vice Dean on International
niques—information security management systems—overview Affairs of the MEPhI’s Infor-
and vocabulary (2016) mation Security Faculty. She
37. Moyle, E.: Three steps to better security in IoT devices. http:// has 25 years of experience in
internetofthingsagenda.techtarget.com/tip/Three-steps-to-better- the field of information security.
IoT-device-security-in-the-enterprise (2016). Accessed 7 Jan At present her research interests
2018 lie in information security
38. Overview of the Digital Object Architecture: Corporation for management systems and net-
National Research Initiatives. http://www.cnri.reston.va.us/ work security of different types
papers/OverviewDigitalObjectArchitecture.pdf (2012). Accessed of systems, for example, of the
7 Jan 2018 open systems (such as the
39. BITAG: Internet of Things (IoT) security and privacy recom- Internet and Intranets) and the
mendations. http://www.bitag.org/documents/BITAG_Report_-_ automated banking systems. She does research on security solutions
Internet_of_Things_(IoT)_Security_and_Privacy_Recommenda (in particular SIEM, NGFW, IDPS, security scanners, VPN), services
tions.pdf (2016). Accessed 7 Jan 2018 and policies. She lectures at MEPhI for students and masters and at
40. Symantec: An Internet of Things reference architecture. https:// the retraining courses for the Russian banking specialists and super-
www.symantec.com/content/en/us/enterprise/white_papers/iot- vises graduates/post-graduates. She wrote or co-authored 62 text-
security-reference-architecture-wp-en.pdf (2015). Accessed 7 Jan books for her original educational courses in MEPhI. She actively
2018 participated in the development of the ‘‘Business Continuity and
41. D’Abreo, C.: What CIOs need to know about IoT and security Information Security Maintenance’’ Master’s degree programme, in
risks. https://www.masergy.com/blog/what-cios-need-know- implementation of which she is very deeply involved. 39 times she
about-iot-and-security-risks (2015). Accessed 7 Jan 2018 was an international conferences PC member, co-chair and chair. She
42. Hollnagel, E., Nemeth, C.P., Dekker, S.W.A. (eds.): Resilience has more than 310 publications (in Russian and English). At present
Engineering Perspectives. Ashgate, Farnham (2008) for the third time she is an IFIP TC11 WG11.8 Vice Chair on
43. Burnham, J.: What is security intelligence and why does it matter Information Security Education. Among her main awards are the
today? https://securityintelligence.com/what-is-security-intelli highest internal IFIP Silver Core 2013 Award, INFOFORUM 2015
gence-and-why-does-it-matter-today/ (2011). Accessed 7 Jan Silver Dagger for the strengthening of international cooperation in the
2018 field of information security and 2016 Best Reviewer Award from
44. Hutchins, E.M., Clopperty, M.J., Amin, R.M.: Intelligence-Dri- SDIWC.
ven Computer Network Defense Informed by Analysis of
Adversary Campaigns and Intrusion Kill Chains. Lockheed Alexander Tolstoy after gradu-
Martin Corporation, Bethesda (2013) ating NRNU MEPhI works at
45. Threat Intelligence Platforms: ThreatConnect, Inc. http://www. MEPhI. He was a Vice Dean on
informationweek.com/whitepaper/ (2015). Accessed 7 Jan 2018 Educational Work of the
46. SAS: Security intelligence. Prevent fraud. Achieve compliance. MEPhI’s Information Security
Preserve security. https://www.sas.com/en_us/software/fraud- Faculty. He has 30 years of
security-intelligence.html (2016). Accessed 7 Jan 2018 experience in the field of infor-
47. Miloslavskaya, N., Tolstoy, A., Migalin, A.: ‘‘Network security mation security. At present his
intelligence’’ educational and research center. In: Bishop, M., research interests lie in infor-
Futcher, L., Miloslavskaya, N., Theocharidou, M. (eds.) Infor- mation security management
mation Security Education for a Global Digital Society. WISE systems and network security of
2017. IFIP Advances in Information and Communication Tech- different types of systems, for
nology, vol. 503, pp. 157–168. Springer, New York (2017) example, of the open systems
48. Nielson, B.: Blockchain solutions for cyber & data security. (such as the Internet and Intra-
https://richtopia.com/emerging-technologies/blockchain-solu nets) and the automated banking
tions-for-cyber-data-security. Accessed 07 Jan 2018 systems. He does research on security policies and security education.
He lectures at MEPhI for students and masters and at the retraining
courses for the Russian banking specialists and supervises gradu-
ates/post-graduates. He wrote or co-authored 62 textbooks for his
original educational courses in MEPhI. He actively participated in the
development of the ‘‘Business Continuity and Information Security
Maintenance’’ Master’s degree programme, in implementation of
which he is very deeply involved. He has more than 300 publications
(in Russian and English).

123