Upload
others
View
4
Download
0
Embed Size (px)
Citation preview
Threat modeling IoTGrega Prešeren
PhysicalCyber
Cloud
Embedded
Wireless
Mobile
CPS
SECURITYBY DESIGN
START TO FINISH
END TO END
DEFENSEIN DEPTH
START TO FINISH
END TO END
3GPP
IEC
IETF
ETSI
Industrie 4.0
ITU-T
IoTSF
GSMA
NIST
OASIS
OWASP IoT Top TenI1 Insecure Web Interface
I2 Insufficient Authentication/Authorization
I3 Insecure Network Services
I4 Lack of Transport Encryption
I5 Privacy Concerns
I6 Insecure Cloud Interface
I7 Insecure Mobile Interface
I8 Insufficient Security Configurability
I9 Insecure Software/Firmware
I10 Poor Physical Security
A1 Injection
A2 Broken Authentication and Session Management
A3 Cross-Site Scripting (XSS)
A4 Insecure Direct Object References
A5 Security Misconfiguration
A6 Sensitive Data Exposure
A7 Missing Function Level Access Control
A8 Cross-Site Request Forgery (CSRF)
A9 Using Components with Known Vulnerabilities
A10 Unvalidated Redirects and Forwards
M1 Improper Platform Usage
M2 Insecure Data Storage
M3 Insecure Communication
M4 Insecure Authentication
M5 Insufficient Cryptography
M6 Insecure Authorization
M7 Client Code Quality
M8 Code Tampering
M9 Reverse Engineering
M10 Extraneous Functionality
R1 Accountability and Data Ownership
R2 User Identity Federation
R3 Regulatory Compliance
R4 Business Continuity and Resiliency
R5 User Privacy and Secondary Usage of Data
R6 Service and Data Integration
R7 Multi Tenancy and Physical Security
R8 Incidence Analysis and Forensic Support
R9 Infrastructure Security
R10 Non Production Environment Exposure
Sensor Actuator
Device Thing
ControllerGateway Middleware Application
EDGE TIER PLATFORM TIER ENTERPRISE TIER
ACC
ESS
NET
WO
RK
(Int
erne
t)
SERV
ICE
NET
WO
RK
(Int
erne
t)
PRO
XIM
ITY
NET
WO
RK
PRO
XIM
ITY
NET
WO
RK
ING
ESTI
ON
STO
RAG
E
AI /
ANAL
YTIC
S
MAN
AGEM
ENT
ENTERPRISE
VISU
ALIZ
ATIO
N