Security Analysis for IoT Components in Industries - ABC Company

This case study analyzes the security of IoT components within industrial settings. It begins by defining the concept of IoT and its increasing adoption in various sectors, highlighting the need for robust security measures. The study discusses three recent variants of attacks against IoT devices: botnets, Denial of Service (DoS) attacks, and Man-in-the-Middle attacks, providing detailed specifications for each. Following this, the study identifies and evaluates three countermeasures and formal security protection techniques, including secure boot and firmware integrity, communal authentication, and security checking and exploration. Finally, the case study specifies two authentication protocols for IoT devices: a lightweight mutual authentication protocol and the OAuth protocol. The conclusion emphasizes the importance of proactive security measures, including encryption and real-time monitoring, to mitigate the risks associated with IoT devices and protect sensitive data. The document highlights the increasing number of attacks and different types of attacks incorporated by the hackers to take advantage of the current scenario and develop advantages against the company’s reputation. The study recommends the organizations to develop standard protocols against these issues such as the OAuth protocol and the lightweight authentication protocols to tighten their security systems from both the ends of the connected devices.

Running head: SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
Name of the student:
Name of the university:
Author Note:

1SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
Table of Contents
1. Introduction............................................................................................................................2
2. Discussion..............................................................................................................................2
2.1. Comparison and discussion of three recent variants of attacks against IoT devices......2
2.2. Identification and Evaluation of the three various countermeasures and formal security
protection techniques against IoT attacks..............................................................................6
2.3. Two authentication protocols specified to IoT devices...................................................7
3. Conclusion..............................................................................................................................8
References..................................................................................................................................9

2SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
1. Introduction
The ‘Internet of Things (IoT)’ is the concept of creating network between the daily
life objects with embedded software, sensors and electronic network for the sole purpose of
exchanging data to extract relevant information from them (Jalali et al. 2016). Organizations
are renovating their infrastructures into smart offices that incorporates connectivity by
Internet amongst the devices used in the workplace to improve the various aspects of life and
enhancing a flexible work structure. These smart devices with the power of AI and algorithm,
network connectivity and methods of collecting data improves the functionality of the work
system at large.
The most popular smart device incorporated by various companies are the smart inter-
connected printers that provides other services than just network printing (Tsiropoulou,
Paruchuri and Baras 2017). These printers are able to monitor the ink level and paper
availability and automatically updates the inventory system for the requirement of new
cartridges without any manual interaction. The smart bulbs used in the companies can adjust
the brightness and colour balance in the cabins and thus save both energy and cost at the
same time (Khutsoane, Isong and Abu-Mahfouz 2017). The smart asset trackers are one of
the best innovations of IoT as it helps in tracking the devices of the office.
2. Discussion
2.1. Comparison and discussion of three recent variants of attacks against IoT
devices.
Variants of Attacks Specifications
Botnets  A network of systems that are assembled together for
remotely taking control over the devices to distribute

3SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
malware.
 Botnet operators with the help of command and control
servers (C&C servers) control the smart systems in the
network (Stiawan et al. 2019).
 Criminals use botnets on a large scale to: a) to steal
confidential information, b) exploit the data from online-
banking systems, c) for spamming and phishing mails or
DDos-attacks.
 Botnets that connect independent smart and connected
objects called thingbots put the smart devices in danger due
to the hacking of the network via Internet.
 Different devices of botnets or thingbots are computers,
laptops, tablets, smartphones, and many more.
 The two main characteristics of botnets are: a) they use the
connection of Internet to breach into the network and can
function only with the presence of an Internet connection, b)
with the help of the high-speed Internet connectivity, the
botnets or thingbots can automatically transmit data from
one device to another via a network (Kolias et al. 2017).
 The anti-spam technology is able to detect very easily if one
machine sends numerous identical mails to various other
devices for spamming (Huang et al. 2020). However, it is
difficult to detect whether the devices that are used to send
the spam mails are a part of the botnet network system or
not.

4SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
 The goal of the devices in the botnet system is to send
innumerable number of spam mails such that the network
platform crashes down with the massive number of requests.
Denial of Service  This type of attack occurs when a service that generally
works is unavailable due to some specific reasons.
 Although the service may be unavailable due to various
reasons, the most common issue is the inability of the
infrastructure to cope up due to overload in capacity.
 In a DDos type of attack, an uncountable number of systems
maliciously attacks on one single target (Tseng et al. 2017).
 This single attack on one machine is done by the use of a
botnet network system where programming is done on
multiple devices to request for a service at the same time.
 The owner of the systems is unaware in this type of attack
about which devices in the system of botnets are assigned to
perform this attack.
 The DDos kind of attack does not derive personal
information or makes way for security loss like the brute-
force attack or phishing attacks (Bertino and Islam 2017).
 However, if a company is victimised of DDos attacks it will
be at the cost of reputation, money and a lot of time.
 Thus, the customers very often switch over to the other
competitors due to the fright of security problems and by
choice does not allow for unavailability of services.
Man-in-the-Middle  As the name suggests, one middle person who is the attacker

5SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
Concept or the hacker finds an opportunity to interrupt and breach
the communication between two individually separate
systems.
 This type of attack is dangerous because the separate
systems possess the concept that they are in direct
communication with each other.
 However, it is the intermediary or the hacker who is secretly
transferring the messages between the two systems and are
able to get access to the messages; thus impeding privacy.
 Since the attacker has an access to the messages, he can
convince the victim that the messages exchanged between
them are legitimate and relevant (Angrishi 2017).
 These kind of attacks are highly common in smart devices
such as the vehicles and the refrigerators or smart fax
machines.
 The industrial tools, smart machineries and other connecting
devices of the current generation are highly prone to these
attacks.
2.2. Identification and Evaluation of the three various countermeasures and
formal security protection techniques against IoT attacks.
Secure Boot and Integrity of Firmware: The security boot is the phenomenon of
booting of the IoT devices using cryptographic code signing methods. These methods are
responsible for ensuring that the smart devices executes code that are solely generated by the
originally equipped manufacturer or any other trusted party. If the companies start using

6SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
securely booting techniques, they will be able to prevent the hackers from replacing the
firmware with sets of malicious instructions and thereby safeguard the devices from severe
attacks. The companies should also ensure in possessing only those smart devices that
consists of IIoT chipsets and are capable of secure booting techniques (Su et al. 2018). The
normal IoT devices in a firmware are prone to receive set of malicious instructions. Thus, the
devices of IIoT chipsets that are only capable of communicating with authorised servers
prove to be less harmful for a company.
Communal Authentication: Authentication from both ends of the smart devices that
are connected to each other helps to prevent malicious attacks at a rapidly reducing rate.
When the two smart devices connect with each other in the office floor, they should prove
their identity from each side to ensure that they are authentic devices and no third party is
breaching the network between them. Only after the authentication from both ends, the
devices can prove that they are legitimate and no fraud case is happening in between the
connection of the two devices. Once the devices approve of each other’s identity, they can
transfer the data from one device to another or exchange relevant and confidential
information between them. In case of the authentication procedure, the devices can
incorporate cryptographic algorithms on both ends and thus implementing symmetric as well
as asymmetric keys for the two-way process of authentication (Butun, Österberg and Song
2019). For instance, the Secure Hash Algorithm (SAH) can use the authenticated code of
hash-based message for implementing symmetric keys and the Elliptic Curve Digital
Signature Algorithm for the asymmetric key implementation.
Security Checking and Exploration: The supervision of security is the phenomenon
of capturing data from all the smart devices incorporated in the industrial system including
the devices at the endpoints and the connectivity of the traffic. Once the data is captured, it is
send for verification and analysis to detect if it incorporates security violations at any stage or

7SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
possess potential threats to the system (Rathinavel et al. 2017). If any detect is identified,
precautionary measures should be taken by the company adhering to the policies of the
security of the systems, such as withdrawing the credentials of the device or secluding the
concerned device for the anomalies in its behaviour (Meng et al. 2018). This automatic act of
supervision will help in detecting the potential attack scenarios in advance and prevent from
further IoT device attacks. Although it is difficult to ensure that the ends of the IoT devices
will not be tampered or manipulated, this continuous monitoring of data will report the events
on a regular basis to enhance ideas for preventing them.
2.3. Two authentication protocols specified to IoT devices
Lightweight Mutual Authentication Protocol: This authentication protocol is based
on the application of the novel public key encryption appropriate for the smart industrial
sectors. The proposal enhances the communication and efficiency in the data transactions of
the systems without compromising tight security between them. The protocol is capable of
resisting the man-in-the-middle type of attacks or brute-force and impersonation attacks
(Hammi et al. 2017). This protocol is responsible for ensuring communal authentication in
both the devices and incorporates the usage of four algorithms such as the system setup
(Setup), the key generation (KeyGen), the Encrypt and the Decrypt algorithm (Wang et al.
2018). The encryption scheme proposed in this protocol is capable of adapting various
settings of parameter, however, strong computational as well as storage capabilities will be
required for larger values of parameters. The primary challenge of incorporating this protocol
is avoiding heavy computations associated with the parameter values.
OAuth Protocol: The OAuth is a standard industry-based protocol that focuses on the
simple development of communications amongst the clients and along with that ensures flow
of specific authorisations in the desktop applications, smart devices and IoT infrastructures
(Arnaboldi and Tschofenig 2019). The OAuth protocol stands for open standard authorization

8SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
procedure or structure. From the name, it is clearly visible, that the protocol allows the
unrelated servers as well as the services to incorporate verified and authenticated access to
the smart applications and devices without sharing the login credentials at any stage (Fett,
Küsters and Schmitz 2016). This type of authentication is recognised popularly as secure and
delegated authorization. This protocol was released as an open standard in the year of 2010;
however, the current adopters of this seamless standard protocol are the renowned
organizations like Amazon, Microsoft, LinkedIn and many more.
3. Conclusion
The introduction of smart systems in the companies are leading them to adopt the
technological progress and enhanced data flow in their operational processes. However,
breaching of networks and leakage of confidential information are enough to create an impact
of the goodwill of the company and malign the brand identity of the organizations. Hence, to
overcome the different security issues in the IoT devices, the organizations should adopt
efficient security measures and standard protocols to ensure security in the smart components
in the industrial sector. The lack of encryption is one of the major issues faced by the
organizations nowadays because they mostly allow their professionals with the ‘Bring your
Own Device’ facilities and does not implement encryption in those devices to tighten the
security system of the company.
As a result, there is an increase in the number of attacks as well as there are different
types of attacks incorporated by the hackers to take advantage of the current scenario and
develop advantages against the company’s reputation. To combat this scenario, the
organizations prepare themselves with counteractive measures such as monitoring the
security systems mostly in real-time scenarios to detect the gap in security and take
precautionary measures. In conclusion, the companies should develop standard protocols

9SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
against these issues such as the OAuth protocol and the lightweight authentication protocols
to tighten their security systems from both the ends of the connected devices.
References
Angrishi, K., 2017. Turning internet of things (iot) into internet of vulnerabilities (iov): Iot
botnets. arXiv preprint arXiv:1702.03681.
Arnaboldi, L. and Tschofenig, H., 2019. A Formal Model for Delegated Authorization of IoT
Devices Using ACE-OAuth. In OAuth Security Workshop.
Bertino, E. and Islam, N., 2017. Botnets and internet of things security. Computer, 50(2),
pp.76-79.
Butun, I., Österberg, P. and Song, H., 2019. Security of the internet of things: vulnerabilities,
attacks and countermeasures. IEEE Communications Surveys & Tutorials.
Fett, D., Küsters, R. and Schmitz, G., 2016, October. A comprehensive formal security
analysis of OAuth 2.0. In Proceedings of the 2016 ACM SIGSAC Conference on Computer
and Communications Security (pp. 1204-1215).
Hammi, M.T., Livolant, E., Bellot, P., Serhrouchni, A. and Minet, P., 2017, June. A
lightweight mutual authentication protocol for the IoT. In International Conference on
Mobile and Wireless Technology (pp. 3-12). Springer, Singapore.
Huang, K., Yang, L.X., Yang, X., Xiang, Y. and Tang, Y.Y., 2020. A Low-Cost Distributed
Denial-of-Service Attack Architecture. IEEE Access.
Jalali, F., Vishwanath, A., De Hoog, J. and Suits, F., 2016, November. Interconnecting Fog
computing and microgrids for greening IoT. In 2016 IEEE Innovative Smart Grid
Technologies-Asia (ISGT-Asia) (pp. 693-698). IEEE.

10SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
Khutsoane, O., Isong, B. and Abu-Mahfouz, A.M., 2017, October. IoT devices and
applications based on LoRa/LoRaWAN. In IECON 2017-43rd Annual Conference of the
IEEE Industrial Electronics Society (pp. 6107-6112). IEEE.
Kolias, C., Kambourakis, G., Stavrou, A. and Voas, J., 2017. DDoS in the IoT: Mirai and
other botnets. Computer, 50(7), pp.80-84.
Meng, Y., Zhang, W., Zhu, H. and Shen, X.S., 2018. Securing consumer IoT in the smart
home: Architecture, challenges, and countermeasures. IEEE Wireless
Communications, 25(6), pp.53-59.
Rathinavel, K., Pipattanasomporn, M., Kuzlu, M. and Rahman, S., 2017, April. Security
concerns and countermeasures in IoT-integrated smart buildings. In 2017 IEEE Power &
Energy Society Innovative Smart Grid Technologies Conference (ISGT) (pp. 1-5). IEEE.
Stiawan, D., Idris, M., Malik, R.F., Nurmaini, S., Alsharif, N. and Budiarto, R., 2019.
Investigating Brute Force Attack Patterns in IoT Network. Journal of Electrical and
Computer Engineering, 2019.
Su, X., Wang, Z., Liu, X., Choi, C. and Choi, D., 2018. Study to improve security for IoT
smart device controller: drawbacks and countermeasures. Security and Communication
Networks, 2018.
Tseng, H.Y., Lee, C.T., Lin, C.A. and Chou, P.H., 2017, April. IoT Metadata Creation
System for Mobile Images and Its Applications. In 2017 IEEE Symposium on Service-
Oriented System Engineering (SOSE) (pp. 63-68). IEEE.
Tsiropoulou, E.E., Paruchuri, S.T. and Baras, J.S., 2017, March. Interest, energy and
physical-aware coalition formation and resource allocation in smart IoT applications. In 2017
51st Annual Conference on Information Sciences and Systems (CISS) (pp. 1-6). IEEE.

11SECURITY ANALYSIS FOR IOT COMPONENTS IN INDUSTRIES
Wang, K.H., Chen, C.M., Fang, W. and Wu, T.Y., 2018. On the security of a new ultra-
lightweight authentication protocol in IoT environment for RFID tags. The Journal of
Supercomputing, 74(1), pp.65-70.