A Comprehensive Approach for Applying Threat Modeling to Internet of Things Systems

Abstract

Internet of Things (IoT) technologies are being increasingly used by society. Industry, Agriculture, and Healthcare are examples of areas where IoT is intensively used. In this way, security became a primary concern for IoT systems since its lack can cause considerable damages from the disclosure of restricted information to the loss of lives. Threat Modeling is a well-known approach to mitigating security threats in information systems. However, to appropriately applying Threat Modeling to the IoT context is necessary to adjust the modeling to consider attacks that affect the security of those systems. This work presents a comprehensive approach for applying threat modeling to IoT systems. We performed survey-of-surveys on attacks and countermeasures for IoT and used this survey as input for traditional Threat Modeling techniques such as STRIDE and DREAD. We applied the adjusted approach to an open-source smart lock system finding some possible attacks. We present the process's steps to other practitioners performing threat modeling for IoT systems.