7026CEM Security of Emerging Connected Systems - Coventry University
Coursework - IoT systems design and security evaluation according to OWASP lists
Learning Outcome 1: Propose and implement effective 'defence-in-depth' solutions to mitigate the key technical internet security vulnerabilities that organisations face.
Learning Outcome 2: Design and implement secure private networks for IoT and Bring Your Own Device (BYOD).
Learning Outcome 3: Discuss and debate a wide range of current research and technological advances in network security.
Task
Introduction
You are given access to an IoT environment, representing a home owned by early adopters in the current move to "smart homes". The devices are all from a single manufacturer and you are required to evaluate the security aspects of the system before marketing and sale of the devices.
You will be given access to a testbed network to perform a practical security audit as well as associated documentation for review.
Task Breakdown
1. A security evaluation report on the test-bed system. This is a "white-box" analysis, so you should execute it as a security review rather than penetration test. You can examine any of the files and materials you are given, but any security vulnerability should be demonstrated with a proof-of-concept (PoC) attack that would work without the information gained through white-box testing. Make sure you consider more than just direct attacks on the devices. Also consider what information is exposed about the consumer.
2. A report to the manufacturer on your findings that includes a short review of each problem, along with a brief overview of how it could be solved. For each issue, you should have a more detailed description of the steps you took to discover it, showing enough detail for it to be repeated by the developers.
3. For each vulnerability and security issue, you have to analyse it according to the OWASP® Foundation security topics; the top 10 risks and vulnerabilities, 2014 and 2018.
4. You have to research and report on each possible security issue and give:
The OWASP category each security issue belongs to.
A technical explanation describing of why and how the issue does belong to that category, e.g.:
Programming/application analysis security issue.
Networking security analysis issue.
Or any other field that the issue might relate to.
An alternative technical solution to prevent the issue or issues.
Scope
• You will be given a collection of docker build scripts and Makefiles.
• Although you have access to the non-live versions of the systems, their Dockerfiles, Makefiles and so on, this does not count as a vulnerability. This is just the mechanism by which you gain access to the virtualised IoT environment.
o You can, however, examine all of these files to see if there might be vulnerabilities or security flaws you can demonstrate in the running system.
o This is the equivalent of having the source code for the IoT systems and being able to review the code, making this a "white box" test.
The system
The system is comprised of:
• An MQTT server that coordinates internal messaging and provides a web front-end for the user
• A Database server that stores local information, settings and so on
• A number of devices within the system.
o a temperature sensor
o a heating system
o a light sensor
All of the services are containerised in order to minimise platform dependency. For the purposes of this coursework, you can assume that the underlying platform is secure unless the container itself is compromised. You will be given a separate container for each of the services, and they will function in "virtual mode" while not on actual hardware.
You are also provided with a document describing the design of the infrastructure outside of the containers. You must include this in your assessment, but rather than look for vulnerabilities in the implementation for this part, you must assess the design decisions presented.
Attachment:- IoT systems design and security.rar