1391  Threats, Attacks, and Vulnerabilities Overview

1391.1 Overview

IoT systems face diverse threats from various actors using multiple attack vectors. This comprehensive module covers the threat landscape, vulnerability types, security frameworks, and practical defense strategies for IoT deployments.

NoteKey Takeaway

In one sentence: Attackers exploit the weakest link—understand threats, attack vectors, and vulnerabilities to defend where it matters most.

Remember this rule: Threats target assets via attack vectors exploiting vulnerabilities; know your adversary’s motivation, capability, and opportunity to prioritize defenses effectively.

1391.2 Learning Objectives

By completing this module, you will be able to:

  • Identify common IoT threat actors and their motivations
  • Understand different types of attacks targeting IoT systems
  • Recognize vulnerabilities specific to IoT devices and networks
  • Analyze attack vectors and attack surfaces in IoT deployments
  • Apply the STRIDE threat model for IoT applications
  • Evaluate real-world IoT attack scenarios
  • Implement defensive strategies against common threats
  • Conduct basic vulnerability assessments on IoT devices

1391.3 Module Chapters

This topic is divided into the following focused chapters:

1391.3.1 1. Introduction to IoT Threats

Introduction to IoT Threats and Attacks

  • Learning objectives and prerequisites
  • Why IoT devices are attractive targets
  • Real-world example: The Mirai botnet
  • Common IoT attack types explained
  • The CIA triad and what attackers target
  • IoT attack surfaces overview

1391.3.2 2. Threat Landscape and STRIDE Model

Threat Landscape and STRIDE Model

  • Threat actor classification (script kiddies to nation-states)
  • The 4-quadrant security framework (People, Processes, Physical, Technology)
  • STRIDE threat modeling framework
    • Spoofing, Tampering, Repudiation
    • Information Disclosure, Denial of Service, Elevation of Privilege
  • Common security pitfalls and how to avoid them

1391.3.3 3. OWASP IoT Top 10 Vulnerabilities

OWASP IoT Top 10 Vulnerabilities

  • The 10 most critical IoT security risks
  • Case study: Mirai botnet (2016)
  • Case study: LockState smart locks (2017)
  • Deep dive: IoT botnet attack patterns and defense
  • Security tradeoffs: scanning vs. penetration testing, zero trust vs. perimeter

1391.3.4 4. Security Compliance Frameworks

IoT Security Compliance Frameworks

  • Framework comparison (NIST, ISO 27001, IEC 62443, ETSI EN 303 645, FDA)
  • NIST Cybersecurity Framework for IoT
  • ETSI EN 303 645 - Consumer IoT Security (13 provisions)
  • IEC 62443 - Industrial IoT Security (security levels, zones)
  • FDA Cybersecurity Guidance for Medical IoT
  • Third-party assessment and certification programs

1391.3.5 5. Practice Exercises

IoT Security Practice Exercises

  • Exercise 1: Threat actor analysis and mitigation strategy
  • Exercise 2: STRIDE threat modeling workshop
  • Exercise 3: Vulnerability scanning and assessment
  • Exercise 4: Incident response simulation
  • Exercise 5: OWASP IoT Top 10 audit
  • Exercise 6: Network segmentation design

1391.3.6 6. Interactive Security Tools

Interactive IoT Security Tools

  • IoT Security Risk Calculator (DREAD methodology)
  • Attack Surface Visualizer
  • Component-specific attack and mitigation analysis

1391.3.7 7. Worked Examples

Worked Examples: Threat Modeling and Incident Response

  • Worked Example: Threat modeling for connected medical device (insulin pump)
    • System decomposition, STRIDE analysis, attack trees
    • Risk prioritization, mitigation design, residual risk acceptance
  • Worked Example: Incident response for IoT breach (building automation)
    • Detection, containment, eradication, recovery, lessons learned

1391.4 Quick Reference: Key Concepts

Concept Definition
Threat Actor Entity that might attack: script kiddie, cybercriminal, hacktivist, insider, nation-state
Attack Vector Path attackers use: network exploits, phishing, physical access, firmware tampering
Vulnerability Security weakness: default passwords, unpatched software, missing encryption
STRIDE Threat taxonomy: Spoofing, Tampering, Repudiation, Info Disclosure, DoS, Elevation of Privilege
CIA Triad Security goals: Confidentiality, Integrity, Availability
Defense in Depth Layering multiple security controls for comprehensive protection

1391.6 Prerequisites

Before starting this module, you should be familiar with:

1391.7 What’s Next

After completing this module, continue to: