IOT privacy and Security
- 1. IOT Privacy and security PRESENTED BY : AFIFA ZAFAR & FARWA MUKHTAR
- 2. IOT (Internet of things ) The Internet of things describes the network of physical objects—a.k.a. "things"—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the Internet.
- 3. IOT (Internet of things ) What is it And How it Works
- 4. Risks Factors Security risk Software risk Network risk Privacy risk
- 5. Security risks Device supply chain Devices may be resold pre-programmed with malware. Firmware upgrade OTA may be abused. Applications and services Exposed services and end-user applications may be compromised. Working network User networks are hostile by definition. Cloud service impersonation
- 6. Software risk mitigation Use secure development practices for the platform and language. Trim and re-evaluate third-party software and libraries. (Use sound and proven cryptographic implementations.) Secure the boot process. Authenticate OTA update sources and targets. (Have distinct device signatures for software updates). Pair external devices, such as phones, securely (e.g. secure NFC/Bluetooth).
- 7. Network risk mitigation Different default credentials for all devices. Security on the protocol level. Peer authentication and authorization. Secret sharing Cryptographic one-way hashing Zero knowledge proof Nodes act only as clients towards the network.
- 8. Privacy risks Identity disclosure Device may transmit personally identifiable data. Device transmissions may be recognizable. Location disclosure Device may transmit its explicit location. Device may be itself traceable through its communications.
- 9. Privacy risk mitigation Identity disclosure Pseudonym. Connection anonymization. Location disclosure Pseudonym. Data confidentiality • No direct access to personally identifiable data from devices. • Secure data center / cloud resources.
- 10. Security and privacy first Security and privacy are first-class requirements.(Design from the start with them in mind). Define trust boundaries(Device/gateway, gateway/cloud) Imagine unlawful ways of interacting with the system(Threat modeling)