Deployment optimization of IoT devices through attack graph analysis

Abstract

The Internet of things (IoT) has become an integral part of our life at both work and home. However, these IoT devices are prone to vulnerability exploits due to their low cost, low resources, the diversity of vendors, and proprietary firmware. Moreover, short range communication protocols (e.g., Bluetooth or ZigBee) open additional opportunities for the lateral movement of an attacker within an organization. Thus, the type and location of IoT devices may significantly change the level of network security of the organizational network. In this paper, we quantify the level of network security based on an augmented attack graph analysis that accounts for the physical location of IoT devices and their communication capabilities. We use the depth-first branch and bound (DFBnB) heuristic search algorithm to solve two optimization problems: Full Deployment with Minimal Risk (FDMR) and Maximal Utility without Risk Deterioration (MURD). An admissible heuristic is proposed to accelerate the search. The proposed method is evaluated using a real network with simulated deployment of IoT devices. The results demonstrate (1) the contribution of the augmented attack graphs to quantifying the impact of IoT devices deployed within the organization on security, and (2) the effectiveness of the optimized IoT deployment. CCS CONCEPTS• Security and privacy → Distributed systems security; Mobile and wireless security.

Opportunities and challenges of the Internet of Things

“…Similarly, Butun et al (2019) found that "scalability, transparency and reliability are the most prominent issues to be solved in terms of security-related initiatives" (p. 20). Another challenge associated with the IoT is highlighted by Agmon (2019) who declared that "the competitive IoT device market forces vendors to try and get their products out as fast as they can, prioritizing functionality and the user experience, while ignoring the security aspect" (p. 14). Considering IoT layered architecture, Cvitić et al (2015) have demonstrated that "the first layer (perception one) has the biggest security risk due to the specific limitations of devices and the transmission technology used at this layer" (p. 738).…”

Responses to AHP-style questionnaires regarding the publication "D-Score: An Expert-Based Method for Assessing the Detectability of IoT-Related Cyber-Attacks"

“…Over the years, various methods have been developed as a means of evaluating the security risks associated with the IoT. Among those methods, IoT attack graphs [44], [45], [46] provide a comprehensive view of attacks, and can assist in identifying multi-hop high-risk attack paths in a large-scale environment. A different objective was addressed in [47], where the authors aimed at quantifying the ease of IoT-related attack execution.…”

Advanced Network Sampling with Heterogeneous Multiple Chains

“…Electric power grids can be abstracted as a network to identify abnormal power states [ 8 ]. As the IoT and sensor networks become increasingly pervasive in our live, network analysis has been applied to mitigate emerging security issues [ 9 ]. In addition, in healthcare field, a network can analyze the spread of disease such as MERS and COVID-19 [ 10 ].…”