Authors:
Steve Taylor
1
;
Martin Gilje Jaatun
2
;
Alan Mc Gibney
3
;
Robert Seidl
4
;
Pavlo Hrynchenko
4
;
Dmytro Prosvirin
5
and
Rosella Mancilla
6
Affiliations:
1
University of Southampton, Highfield Campus, SO17 1BJ, U.K.
;
2
SINTEF Digital, PO Box 4760 Torgarden, 7465 TRONDHEIM, Norway
;
3
Munster Technological University, Rossa Avenue, Bishopstown, Cork, Ireland
;
4
NOKIA Bell Labs, Werinherstr. 91, 81541 Munich, Germany
;
5
World Research Center of Vortex Energy, Rustavi Street Building 3 Apartment 47, Zaporizhzhya 69093, Ukraine
;
6
Antonov Aeronautical Scientific & Technical Company, Academika Tupoleva Str. 1, KYIV 03062, Ukraine
Keyword(s):
IoT, Testing (Software Engineering, Penetration, Product Development), Full IoT Lifecycle Testing, Security by Design, Component Level Testing, System Level Testing, Cyber Threat Intelligence (CTI) Sharing.
Abstract:
This paper describes challenges within IoT ecosystems from the perspective of cybersecurity testing along with a proposed approach to address them that will be investigated in a recently started Horizon Europe project named TELEMETRY. The key observations regarding the design of the framework are summarised as follows. There is a need to consider the full lifecycle of IoT components – at their design time, their integration into systems, and operation of those systems. Threats and risks can propagate when components are connected together in systems - vulnerabilities in one component can affect other components in a system. IoT devices present limitations to current testing and management due to geographical distribution, opacity and limited processing power. Risk assessment fulfils an important requirement because it enables assessment of what elements are important to the system’s stakeholders, how these elements may be compromised, and how the compromises may be controlled. Feedba
ck from operational monitoring of IoT devices can inform firmware updates / patches to the devices but there is a significant challenge in rolling out these patches to multiple low-power devices geographically distributed.
(More)