Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Session 1 & 2: Basic and Advanced concepts of IoT architecture from security perspective
- A brief history of the evolution of IoT technologies.
- Data models in IoT systems – definition and architecture of sensors, actuators, devices, gateways, and communication protocols.
- Third-party devices and risks associated with vendor supply chains.
- Technology ecosystem – risks associated with device providers, gateway providers, analytics providers, platform providers, and system integrators.
- Edge-driven distributed IoT vs. Cloud-driven centralized IoT: Advantages and risk assessment.
- Management layers in IoT systems – Fleet management, asset management, sensor Onboarding/Deboarding, and Digital Twins. Risks of authorizations in management layers.
- Demo of IoT management systems including AWS, Microsoft Azure, and other fleet managers.
- Introduction to popular IoT communication protocols – Zigbee, NB-IoT, 5G, LORA, Witespec – and a review of vulnerability in communication protocol layers.
- Understanding the entire IoT technology stack with a review of risk management.
Session 3: A check-list of all risks and security issues in IoT
- Firmware Patching: The soft belly of IoT.
- Detailed review of security for IoT communication protocols: Transport layers (NB-IoT, 4G, 5G, LORA, Zigbee, etc.) and Application Layers – MQTT, Web Socket, etc.
- Vulnerability of API endpoints – a list of all possible APIs in IoT architecture.
- Vulnerability of gateway devices and services.
- Vulnerability of connected sensors and gateway communication.
- Vulnerability of gateway/server communication.
- Vulnerability of cloud database services in IoT.
- Vulnerability of application layers.
- Vulnerability of gateway management services (local and cloud-based).
- Risk of log management in edge and non-edge architecture.
Session 4: OWASP Model of IoT security, Top 10 security risk
- I1: Insecure Web Interface.
- I2: Insufficient Authentication/Authorization.
- I3: Insecure Network Services.
- I4: Lack of Transport Encryption.
- I5: Privacy Concerns.
- I6: Insecure Cloud Interface.
- I7: Insecure Mobile Interface.
- I8: Insufficient Security Configurability.
- I9: Insecure Software/Firmware.
- I10: Poor Physical Security.
Session 5: Review and Demo of AWS-IoT and Azure IoT security principles
- Microsoft Threat Model – STRIDE.
Details of STRIDE Model
- Security of device, gateway, and server communication – Asymmetric encryption.
- X.509 certification for Public key distribution.
- SAS Keys.
- Bulk OTA risks and techniques.
- API security for application portals.
- Deactivation and delinking of rogue devices from the system.
- Vulnerability of AWS/Azure security principles.
Session 6: Review of evolving NIST standards/recommendation for IoT
Review of NISTIR 8228 standard for IoT security – 30-point risk consideration Model.
Third-party device integration and identification.
- Service identification & tracking.
- Hardware identification & tracking.
- Communication session identification.
- Management transaction identification and logging.
- Log management and tracking.
Session 7: Securing Firmware/Device
Securing debugging mode in a Firmware.
Physical Security of hardware.
- Hardware cryptography – PUF (Physically Unclonable Function) – securing EPROM.
- Public PUF, PPUF.
- Nano PUF.
- Known classification of Malwares in Firmware (18 families according to YARA rule).
- Study of some of the popular Firmware Malware – MIRAI, BrickerBot, GoScanSSH, Hydra, etc.
Session 8: Case Studies of IoT Attacks
- On Oct. 21, 2016, a huge DDoS attack was deployed against Dyn DNS servers, shutting down many web services including Twitter. Hackers exploited default passwords and usernames of webcams and other IoT devices, installing the Mirai botnet on compromised IoT devices. This attack will be studied in detail.
- IP cameras can be hacked through buffer overflow attacks.
- Philips Hue lightbulbs were hacked through their ZigBee link protocol.
- SQL injection attacks were effective against Belkin IoT devices.
- Cross-site scripting (XSS) attacks that exploited the Belkin WeMo app, accessing data and resources the app can access.
Session 9: Securing Distributed IoT via Distributer Ledger – BlockChain and DAG (IOTA) [3 hours]
Distributed ledger technology – DAG Ledger, Hyper Ledger, Blockchain.
PoW, PoS, Tangle – a comparison of the methods of consensus.
- Difference between Blockchain, DAG, and Hyperledger – a comparison of their working vs. performance vs. decentralization.
- Real-time, offline performance of different DLT systems.
- P2P network, Private and Public Key basic concepts.
- How ledger systems are implemented practically – review of some research architecture.
- IOTA and Tangle – DLT for IoT.
- Some practical application examples from smart cities, smart machines, smart cars.
Session 10: The best practice architecture for IoT security
- Tracking and identifying all services in Gateways.
- Never use MAC address – use package ID instead.
- Use identification hierarchy for devices – board ID, Device ID, and package ID.
- Structure the Firmware Patching to perimeter and conforming to service ID.
- PUF for EPROM.
- Secure the risks of IoT management portals/applications by two layers of authentication.
- Secure all APIs – Define API testing and API management.
- Identification and integration of the same security principle in Logistic Supply Chain.
- Minimize Patch vulnerability of IoT communication Protocols.
Session 11: Drafting IoT security Policy for your organization
- Define the lexicon of IoT security / Tensions.
- Suggest the best practice for authentication, identification, authorization.
- Identification and ranking of Critical Assets.
- Identification of perimeters and isolation for application.
- Policy for securing critical assets, critical information, and privacy data.
Requirements
- Basic knowledge of devices, electronic systems, and data systems.
- Fundamental understanding of software and systems.
- Basic grasp of Statistics (Excel level proficiency).
- Understanding of Telecommunication Verticals.
Summary
- An advanced training program covering the cutting-edge security of the Internet of Things.
- Covers all aspects of firmware, middleware, and IoT communication protocol security.
- Offers a 360-degree view of security initiatives in the IoT domain for those not deeply familiar with IoT standards, evolution, and future trends.
- Deeply examines security vulnerabilities in firmware, wireless communication protocols, and device-to-cloud communication.
- Crosses multiple technology domains to develop awareness of security within IoT systems and their components.
- Includes live demonstrations of security aspects related to gateways, sensors, and IoT application clouds.
- Explains the 30 principle risk considerations of current and proposed NIST standards for IoT security.
- Covers the OWASP model for IoT security.
- Provides detailed guidelines for drafting IoT security standards for an organization.
Target Audience
Engineers, managers, and security experts tasked with developing IoT projects or auditing and reviewing security risks.
21 Hours
Testimonials (1)
How friendly the trainer was. The flexibility and answering my questions.
