Thank you for sending your enquiry! One of our team members will contact you shortly.
Thank you for sending your booking! One of our team members will contact you shortly.
Course Outline
Session 1 & 2: Basic and Advanced Concepts of IoT Architecture from a Security Perspective
- A brief history of the evolution of IoT technologies for government.
- Data models in IoT systems—definition and architecture of sensors, actuators, devices, gateways, and communication protocols.
- Third-party devices and associated supply chain risks.
- Technology ecosystem—device providers, gateway providers, analytics providers, platform providers, and system integrators. Risk assessment for all providers in the context of government operations.
- Edge-driven distributed IoT versus cloud-driven centralized IoT: advantages and risk assessments.
- Management layers in IoT systems—fleet management, asset management, onboarding/deboarding of sensors, digital twins. Risk assessment of authorizations in management layers.
- Demonstration of IoT management systems, including AWS, Microsoft Azure, and other fleet managers for government use.
- Introduction to popular IoT communication protocols—Zigbee/NB-IoT/5G/LORA/Wi-Spec. Review of vulnerabilities in communication protocol layers.
- Comprehensive review of the entire technology stack of IoT with a focus on risk management for government operations.
Session 3: A Checklist of All Risks and Security Issues in IoT
- Firmware patching: the soft underbelly of IoT for government systems.
- Detailed review of IoT communication protocol security—transport layers (NB-IoT, 4G, 5G, LORA, Zigbee, etc.) and application layers (MQTT, Web Socket, etc.).
- Vulnerabilities in API endpoints—a list of all possible APIs in IoT architecture.
- Vulnerabilities of gateway devices and services.
- Vulnerabilities of connected sensors—gateway communication.
- Vulnerabilities of gateway-server communication.
- Vulnerabilities of cloud database services in IoT for government systems.
- Vulnerabilities of application layers.
- Vulnerabilities of gateway management services—local and cloud-based.
- Risk of log management in edge and non-edge architectures for government operations.
Session 4: OWASP Model of IoT Security, Top 10 Security Risks
- I1 Insecure Web Interface
- I2 Insufficient Authentication/Authorization
- I3 Insecure Network Services
- I4 Lack of Transport Encryption
- I5 Privacy Concerns
- I6 Insecure Cloud Interface
- I7 Insecure Mobile Interface
- I8 Insufficient Security Configurability
- I9 Insecure Software/Firmware
- I10 Poor Physical Security
Session 5: Review and Demonstration of AWS-IoT and Azure IoT Security Principles
- Microsoft Threat Model—STRIDE.
Details of the STRIDE Model for government applications:
- Secure device, gateway, and server communication using asymmetric encryption.
- X.509 certification for public key distribution.
- SAS Keys.
- Bulk OTA risks and techniques.
- API security for application portals in government systems.
- Deactivation and delinking of rogue devices from the system.
- Vulnerabilities in AWS/Azure security principles for government operations.
Session 6: Review of Evolving NIST Standards/Recommendations for IoT
Review of NISTIR 8228 standard for IoT security—a 30-point risk consideration model for government use.
Third-party device integration and identification for government systems:
- Service identification & tracking
- Hardware identification & tracking
- Communication session identification
- Management transaction identification and logging
- Log management and tracking for government operations.
Session 7: Securing Firmware/Devices
Securing debugging mode in firmware for government systems:
Physical security of hardware for government use:
- Hardware cryptography—PUF (Physically Unclonable Function) securing EPROM.
- Public PUF, PPUF
- Nano PUF
- Known classification of malwares in firmware (18 families according to YARA rule).
- Study of some popular firmware malware—Mirai, BrickerBot, GoScanSSH, Hydra, etc., for government applications.
Session 8: Case Studies of IoT Attacks
- On October 21, 2016, a massive DDoS attack was deployed against Dyn DNS servers, shutting down many web services including Twitter. Hackers exploited default passwords and usernames of webcams and other IoT devices, installing the Mirai botnet on compromised IoT devices. This attack will be studied in detail for government context.
- IP cameras can be hacked through buffer overflow attacks.
- Philips Hue lightbulbs were hacked through their ZigBee link protocol.
- SQL injection attacks were effective against Belkin IoT devices for government systems.
- Cross-site scripting (XSS) attacks that exploited the Belkin WeMo app and accessed data and resources that the app can access in government environments.
Session 9: Securing Distributed IoT via Distributed Ledger—Blockchain and DAG (IOTA) [3 hours]
Distributed ledger technology—DAG Ledger, Hyper Ledger, Blockchain for government applications:
PoW, PoS, Tangle—a comparison of consensus methods for government use.
- Differences between blockchain, DAG, and Hyperledger—comparison of their working, performance, and decentralization for government operations.
- Real-time, offline performance of different DLT systems for government.
- P2P network, private and public key—basic concepts for government.
- Practical implementation of ledger systems—review of some research architectures for government use.
- IOTA and Tangle DLT for IoT in government operations.
- Practical application examples from smart cities, smart machines, and smart cars for government.
Session 10: Best Practice Architecture for IoT Security
- Tracking and identifying all services in gateways for government systems.
- Never use MAC address—use package ID instead for government operations.
- Use an identification hierarchy for devices—board ID, device ID, and package ID for government applications.
- Structure firmware patching to the perimeter and conform to service IDs for government systems.
- PUF for EPROM in government hardware.
- Secure the risks of IoT management portals/applications with two layers of authentication for government use.
- Secure all APIs—define API testing and API management for government operations.
- Identification and integration of the same security principles in logistic supply chains for government.
- Minimize patch vulnerabilities of IoT communication protocols for government systems.
Session 11: Drafting an IoT Security Policy for Your Organization
- Define the lexicon of IoT security and tensions for government use.
- Suggest best practices for authentication, identification, and authorization for government systems.
- Identification and ranking of critical assets for government operations.
- Identification of perimeters and isolation for applications in government environments.
- Policy for securing critical assets, critical information, and privacy data for government systems.
Requirements
- Basic knowledge of devices, electronics systems, and data systems for government use
- Fundamental understanding of software and systems
- Basic comprehension of statistics (at the Excel level)
- Understanding of telecommunication verticals
Summary
- An advanced training program for government that covers the current state-of-the-art security measures in the Internet of Things (IoT)
- Addresses all aspects of security for firmware, middleware, and IoT communication protocols
- Provides a comprehensive overview of various security initiatives in the IoT domain, suitable for those who are not deeply familiar with IoT standards, evolution, and future trends
- Conducts an in-depth examination of security vulnerabilities in firmware, wireless communication protocols, and device-to-cloud communication
- Spans multiple technology domains to foster awareness of security within IoT systems and their components
- Includes live demonstrations of security aspects related to gateways, sensors, and IoT application clouds
- Explains 30 principal risk considerations associated with current and proposed NIST standards for IoT security
- Covers the OWASP model for IoT security
- Offers detailed guidelines for drafting IoT security standards within an organization
Target Audience
Engineers, managers, and security experts who are tasked with developing IoT projects or auditing/reviewing security risks for government.
21 Hours
Testimonials (1)
How friendly the trainer was. The flexibility and answering my questions.
