– would break the confidentiality of information and give the intruder the ability to learn and change IoT information 12
– Routing attack: – intruder change the routing information of the IoT device to route packets to other destination or to pause the IoT functionality 13.
– DOS Attacks: – similar to the perception layer, DOS attacks can take place in network layer and cause IoT services to stop.
3.1 IoT Security Countermeasure
Protecting IoT environment for cyberattacks is an essential demand in security worlds, many researches discussed techniques and procedures that can be taken to secure against such attacks.
– Using Digital Certificate and two-way authentication will preserve the confidentiality of data 14, that will make sure every device in IoT environment is a legitimate and genuine device which in turn will prevent the many attacks like Node Tampering, Man in the Middle, Device Impersonation and other attacks.
– Data Encryption will make sure that all data will be only read by authorized parties 15.
– Access Control Lists (ACLS): creating the right rules to control the inbound and outbound of traffic will stop unwanted traffic and monitor access to the IoT devices.
– Intrusion Detection and Prevention: would alarm and prevent any malicious activities on IoT devices.
– Anti-virus would protect IoT devices for different kind of malwares.
– Updating IoT firmware devices will patch bugs and vulnerabilities that attackers can take advantage of to attack against IoT devices.
– Proper IoT devices configuration like change default password and turn on only needed services would protect IoT environment from wide range of attacks.
4. Statement of the problem
Due to the design and functional nature of IoT devices, applying security procedures and policies faces many challenges and difficulties, some of these challenges: –
1- Lack of standards in IoT devices and proprietary techniques and protocols used make understanding IoT threats and deploying security mechanism more challenging and difficult.
2- The limited processing and storage capabilities of IoT devices make applying security features more difficult, like applying encryption method between sensors and IoT devices, most of sensors do not have enough processing power to handle the encryption process which arise the need to develop a lightweight encryption method to apply in IoT devices, the limited storage also prevent users from deploy security mechanism like anti-virus that could fill the storage unit of IoT devices.
3- Most of IoT vendors are not interested to develop imbedded security features as opposed to their interested selling more cheap IoT devices.
All these challenges arise the need to develop mechanisms to protect against threats and attacks.
The proposed framework is stand on four components Authentication, Authorization, Encryption and Cloud Security Service.