IoT Threat Model Builder

Identify and Mitigate IoT Security Threats

Learning Objectives

By playing this game, you will be able to:

  • Identify security threats using the STRIDE framework
  • Analyze IoT system architectures for vulnerabilities
  • Select appropriate mitigations for each threat category
  • Evaluate the effectiveness of security controls
  • Prioritize security investments based on risk assessment
  • Apply defense-in-depth strategies to IoT systems

Threat modeling is like being a security detective πŸ”

Imagine you’re protecting a house. You’d ask: - Where are the doors and windows? (entry points) - What valuables are inside? (assets) - Who might want to break in? (threat actors) - How might they try to get in? (attack vectors) - What can we do to stop them? (mitigations)

STRIDE is a memory helper for 6 types of threats: - Spoofing - Pretending to be someone else - Tampering - Changing data without permission - Repudiation - Denying you did something - Information Disclosure - Data leaking out - Denial of Service - Making things unavailable - Elevation of Privilege - Getting more access than allowed

In IoT systems, devices like sensors, cameras, and smart appliances all need protection. This game teaches you to think like a security professional!

How to Play

  1. Choose Difficulty Level: Easy (4 scenarios), Medium (4 scenarios), or Hard (4 scenarios)
  2. Read the Scenario: Understand the IoT system architecture and assets
  3. Identify Threats: Select the most critical threat from each STRIDE category
  4. Choose Mitigations: Pick security controls to defend against the threat
  5. Run Attack Simulation: Watch how attackers try to exploit your system
  6. Review Results: See which attacks were blocked and which succeeded
  7. Learn & Iterate: Complete all scenarios to master threat modeling

STRIDE Framework Reference

Category Question to Ask Example Threats
Spoofing Can an attacker pretend to be someone/something else? Fake device, stolen credentials, session hijacking
Tampering Can an attacker modify data in transit or at rest? Man-in-the-middle, firmware modification, database manipulation
Repudiation Can users deny their actions? Missing audit logs, unsigned transactions
Information Disclosure Can data be exposed to unauthorized parties? Eavesdropping, data breach, verbose error messages
Denial of Service Can the system be made unavailable? DDoS, resource exhaustion, battery drain attacks
Elevation of Privilege Can an attacker gain higher access? Privilege escalation, remote code execution, root access

Interactive Game

STRIDE

IoT Threat Model Builder

Identify threats and select mitigations for IoT architectures

0
Score
1
Scenario
0
Correct
0
Attacks Blocked
0
Streak