Openness and Security Thinking Characteristics for IoT Ecosystems

Abstract

While security is often recognized as a top priority for organizations and a push for competitive advantage, repeatedly, Internet of Things (IoT) products have become a target of diverse security attacks. Thus, orchestrating smart services and devices in a more open, standardized and secure way in IoT environments is yet a desire as much as it is a challenge. In this paper, we propose a model for IoT practitioners and researchers, who can adopt a sound security thinking in parallel with open IoT technological developments. We present the state-of-the-art and an empirical study with IoT practitioners. These efforts have resulted in identifying a set of openness and security thinking criteria that are important to consider from an IoT ecosystem point of view. Openness in terms of open standards, data, APIs, processes, open source and open architectures (flexibility, customizability and extensibility aspects), by presenting security thinking tackled from a three-dimensional point of view (awareness, assessment and challenges) that highlight the need to develop an IoT security mindset. A novel model is conceptualized with those characteristics followed by several key aspects important to design and secure future IoT systems.

Systematic Mapping Study of Systems Security Engineering for Modular Open Systems

“…Database Reference A secure design-for-test infrastructure for lifetime security of SoCs IEEE [14] Safety and security aware framework for the development of feedback control systems IEEE [15] Designing safe and secure autopilots for the urban environment IEEE [16] Cyber-Physical Systems Security-A Survey IEEE [8] Open Platform Systems Under Scrutiny: A Cybersecurity Analysis of the Device Tree IEEE [17] Cyber Security Concerns Regarding Federated, Partly IMA and Full IMA Implementations IEEE [18] The Need for a Secure Modular Open Systems Approach (MOSA): Building the Case Using Systems Thinking Methodologies IEEE [9] Attacks on Distributed Sequential Control in Manufacturing Automation IEEE [19] A Multicycle Pipelined GCM-Based AUTOSAR Communication ASIP IEEE [20] Cyber-Attacks in Modular Multilevel Converters IEEE [21] Securing Robots: An Integrated Approach for IEEE [22] Security Challenges and Monitoring for the Robotic Operating System (ROS) Security Threat Analysis and Treatment Strategy for ORAN IEEE [23] Security Risk Assessment and Risk Treatment for Integrated Modular Communication Scopus [24] Big Missions, Small Solutions Advances and Innovation in Architecture and Technology for Small Satellites Scopus [10] Considerations and examples of a modular open systems approach in defense systems Scopus [7] Security Mechanisms Used in Microservices-Based Systems: A Systematic Mapping Scopus [25] Security Considerations in Modular Mobile Manipulation Scopus [26] Openness and Security Thinking Characteristics for IoT Ecosystems Scopus [27] Railway Defender Kill Chain to Predict and Detect Cyber-Attacks Scopus [28] Mission Systems Open Architecture Science and Technology (MOAST) program SPIE [29] Joint Communications Architecture for Unmanned Systems (JCAUS) SPIE [30] Designing the next generation of sensor systems using the SOSA standard SPIE [31] A systems approach to achieving the benefits of open and modular systems SPIE [32] Chaos engineering experiments in middleware systems using targeted network degradation and automatic fault injection SPIE [33] Protecting publish/subscribe interactions via TLS and a system-wide certificate validation engine SPIE [34] Secure Internet of Things Architecture (SIoTA) on the battlefield SPIE…”

“…SA-11 Developer Testing and Evaluation and SA-3 System Development Lifecycle were the top two control categories extracted for this family. SA-11 covers functions from literature such as risk management [27], security assessments and testing [8][18], fuzzing [22][42], penetration testing and static code analysis [42]. Security functions that fall under SA-3 are secure integration of components into the system [8], rapid upgrades [7][10], and technology refresh (of security modules or compromised non-security modules) [7][30] and securing the design and manufacturing lifecycle process of a system [8] [18].…”

A Proposal to Improve Interoperability in the Industry 4.0 Based on the Open Platform Communications Unified Architecture Standard

“…In the IoT domain, several leading standard development organizations have been working on developing standards for solving the current fragmentation of the IoT landscape [17]; among these standards is that called oneM2M [18].…”