Security Metrics at Work on the Things in IoT Systems

Abstract

The Internet of Things (IoT) is deeply changing our society. Daily we use smart devices that automatically collect, aggregate and exchange data about our lives. These data are often pivotal when they are used e.g. to train learning algorithms, to control cyber-physical systems, and to guide administrators to take crucial decisions. As a consequence, security attacks on devices can cause severe damages on IoT systems that take care of essential services, such as delivering power, water, transport, and so on. The difficulty of preventing intrusions or attacks is magnified by the big amount of devices and components IoT systems are composed of. Therefore, it is crucial to identify the most critical components in a network of devices and to understand their level of vulnerability, so as to detect where it is better to intervene for improving security. In this paper, we start from the modelling language IoT-LySa and from the results of Control Flow Analysis that statically predict the manipulation of data and their possible trajectories. On this basis, we aim at deriving possible graphs of how data move and which are their dependencies. These graphs can be analysed, by exploiting some security metrics -among which those introduced by Barrere, Hankin et al. -offering system administrators different estimates of the security level of their systems. Partially supported by Università di Pisa PRA_2018_66 DECLWARE: Metodologie dichiarative per la progettazione e il deployment di applicazioni and by MIUR project PRIN 2017FTXR7S IT MATTERS (Methods and Tools for Trustworthy Smart Systems). := (x c ch I check I ≥ cr I thI ). alarmI c al I , 1CR, ring .h ACR = µh.(1CR, {Ring}).τ.h

A Security Cost Modelling Framework for Cyber-Physical Systems

“…Other related work use methods and frameworks to evaluate how secure e.g. a system is [12,14,15,35,46,49]. In other words, these solutions focus on evaluating whether a security control has been implemented or not and how much effort it takes (or how much it costs) to do so.…”

“…[30, 50-52] Measuring how secure a specific system is (level of security). [12,14,15,35,46,49] Measuring the impact of various cyber-crime attacks.…”

A Formal Approach to the Engineering of Domain-Specific Distributed Systems

“…More generally, by analysing the abstract paths derived from the model it is possible to identify crucial code structures. We refer to [29,30] for more details.…”