Framework to measure and reduce the threat surface area for smart home devices

Abstract

Threat surface area for the Internet of Things is calculated as the sum of security vulnerabilities or the weakness and gaps in protection efforts for the device, operating systems, associated software applications, and the local infrastructure. This aggregates all the known and unknown threats that can potentially expose the device, logs, data, and hosted applications. By reducing the exposed elements of the device surface, the device vulnerabilities can decrease the exposed threat surface area. This research presents a new framework first to map the devices in the ecosystem, measure the potential threat surface area from the exposure indicators for each layer and then determine the threat vectors for device compromise to calculate the maturity and severity levels. The authors propose new metrics to reassess and re-calculate the maturity and severity levels. Based on the new metrics, newly exposed threat surface elements provide a new security perspective beneficial for stakeholders involved in design, implementation, and security ecosystem of smart devices.