Strategic Security Audit Protocol: Safeguarding Smart Home IoT Devices against Vulnerabilities
Arshad Ahmad Dar, Faheem Ahmad Reegu, Sarfaraz Ahmed, Gousiya Hussain · 2024
The world is experiencing a fast convergence of physical and cyber systems as objects used in day-to-day life are connected over the internet. These IoT devices are mass produced but ensure its usage in routine life. The impact of IoT in human life ranges from simple household equipment to life critical devices. Owing to the diversity both in application and nature, security had become a major concern on these devices and their applications. In spite of having many security frameworks and compliance regulations, attacks and on IoTs are exponentially growing. A handful of security frameworks are available for ensuring the security, there are very less frame works proposed for auditing the security. Confidentiality, Integrity and Availability which are the pillars of security in IoT are found missing or found to have been implemented with flaws. IoT security audit is one good solution which has proven success in the literature but challenging as the high level standards cannot be applied to low level device and applications. In addition, the challenges of audit include heterogeneity of IoT and lack of expert resources. IoT and related products reach market very quickly before it could be subjected to the complete audit procedures or in other words, the time taken for a new IoT device or application to be developed is very less than the time taken for developing an security audit mechanism. Hence, to enable an efficient security auditing of IoT devices, a definite and dynamic framework is needed that can propose feasible policies, automatic collection and analysis of audit data and tailor made procedures for risk assessment, risk control and risk mitigation. This Research focuses on the auditing of security vulnerability in IoT devices. A gradational methodology is proposed for extracting the feasible security checks from leading standards and guidelines in the IoT domain.