More Like this

1. A Capstone Project: Designing an IoT Threat Modeling to Prevent Cyber-attacks

   Toutsop, O. ( November 2021 , 2021 Fall ASEE Middle Atlantic Section Meeting)

   The NTT (Nippon Telegraph and Telephone) Data Corporation report found that 80% of U.S. consumers are concerned about their smart home data security. The Internet of Things (IoT) technology brings many benefits to people's homes, and more people across the world are heavily dependent on the technology and its devices. However, many IoT devices are deployed without considering security, increasing the number of attack vectors available to attackers. Numerous Internet of Things devices lacking security features have been compromised by attackers, resulting in many security incidents. Attackers can infiltrate these smart home devices and control the home via turning off the lights, controlling the alarm systems, and unlocking the smart locks, to name a few. Attackers have also been able to access the smart home network, leading to data exfiltration. There are many threats that smart homes face, such as the Man-in-the-Middle (MIM) attacks, data and identity theft, and Denial of Service (DoS) attacks. The hardware vulnerabilities often targeted by attackers are SPI, UART, JTAG, USB, etc. Therefore, to enhance the security of the smart devices used in our daily lives, threat modeling should be implemented early on in developing any given system. This past Spring semester, Morgan State University launched a (senior) capstone project targeting undergraduate (electrical) engineering students who were thus allowed to research with the Cybersecurity Assurance and Policy (CAP) center for four months. The primary purpose of the capstone was to help students further develop both hardware and software skills while researching. For this project, the students mainly focused on the Arduino Mega Board. Some of the expected outcomes for this capstone project include: 1) understanding the physical board components, 2) learning how to attack the board through the STRIDE technique, 3) generating a Data Flow Diagram (DFD) of the system using the Microsoft threat modeling tool, 4) understanding the attack patterns, and 5) generating the threat based on the user's input. To prevent future threats and attacks from taking advantage of systems vulnerabilities, the practice of "threat modeling" is implemented. This method allows the analysis of potential attackers, including their goals and techniques, while also providing solutions and mitigation strategies. Although Threat modeling can be performed throughout the development of a system, implementing it during developmental stages will prevent further problems in the future. Threat Modeling is crucial because it will help identify any potential threat before it propagates in the system. Identifying threats and providing countermeasures will save both time and money while also keeping the consumers safe. As a result, students must grow to understand how essential detecting and preventing attacks are to protect consumer information systems and networks. At the end of this capstone project, students should take away hands-on skills in cyber defense. 

   more » « less
2. Towards a Layered and Secure Internet-of-Things Testbed via Hybrid Mesh

   https://doi.org/10.1109/ICIOT.2018.00010  

   Jones, Tyler ; Dali, Aniket ; Rao, Manoj Ramesh ; Biradar, Neha ; Madassery, Jean ; Liu, Kaikai ( July 2018 , 2018 IEEE International Congress on Internet of Things (ICIOT))

   The Internet of Things (IoT) is an emerging technology that aims to connect our environment to the internet in the same way that personal computers connected people. As this technology progresses, the IoT paradigm becomes more prevalent in our everyday lives. The nature of IoT applications necessitates devices that are low-cost, power-sensitive, integrated, unobtrusive, and interoperable with existing cloud platforms and services, for example, Amazon AWS IoT, IBM Watson IoT. As a result, these devices are often small in size, with just enough computing power needed for their specific tasks. These resource-constrained devices are often unable to implement traditional network security measures and represent a vulnerability to network attackers as a result. Few frameworks are positioned to handle the influx of this new technology and the security concerns associated with it. Current solutions fail to provide a comprehensive and multi-layer solution to these inherent IoT security vulnerabilities. This paper presents a layered approach to IoT testbed that aims to bridge multiple connection standards and cloud platforms. To solve challenges surrounding this multi-layer IoT testbed, we propose a mesh inside a mesh IoT network architecture. Our designed "edge router" incorporates two mesh networks together and performs seamlessly transmission of multi-standard packets. The proposed IoT testbed interoperates with existing multi-standards (Wi-Fi, 6LoWPAN) and segments of networks, and provides both Internet and resilient sensor coverage to the cloud platform. To ensure confidentiality and authentication of IoT devices when interoperating with multiple service platforms, we propose optimized cryptographic techniques and software frameworks for IoT devices. We propose to extend and modify the existing open-source IDS platforms such as Snort to support IoT platforms and environments. We validate the efficacy of the proposed system by evaluating its performance and effect on key system resources. The work within this testbed design and implementation provides a solid foundation for further IoT system development. 

   more » « less
3. Expanding Literacy’s Boundaries in K-12 with Cloud Literacy (Work in Progress)

   Billionniere, E. ; Meyer, Lawrence E. ( July 2021 , 2021 ASEE Virtual Annual Conference)

   null (Ed.)

   The migration of infrastructure from on premise installation and maintenance of computing resources to cloud based systems by business of all sizes has been an ongoing event for several years. To minimize capital expenses and allow for demand based operational expenses has increased the need for cloud practitioners with the ability to create and control these resources. The demand for skilled cloud workers ranging from developers to architects has been increasing, and one way to increase the technicians available for these job skills is to start recruitment as early as high school. For high school students interested in the technical side of STEM pathways, the ability to understand, design and work in a cloud environment is now part of critical technical skills. Fluency in cloud and cloud environments, the ability to understand the capabilities of all these modern technologies are necessary technical skills. To support this growing demand of cloud skills, the institution partnered with Amazon Web Services (AWS), the industry leader in cloud computing solutions, to train high school students as early cloud adopters and to be well-prepared for the computing/IT workforce of tomorrow. This academic-industry partnership aims to raise cloud literacy in K-12 by offering a two-week cloud computing bootcamp for high school students selected from traditionally underrepresented groups, Hispanic and/or African Americans. The bootcamp used a combination of team teaching, online sandbox repetition and experimentation, and project-based practice. The AWS materials provided by AWS Academy covered the details of the AWS infrastructure and were coupled with AWS Educate classroom sandboxes for practice. The two-week intensive practice and review certified 21 out of 31 high school students in the AWS Cloud Practitioner certification. This was the first time AWS Academy authorized high school students to take the certification exam and currently the largest cohort of high school students as AWS Cloud Practitioners. This paper presents the details of the pilot implementation of the summer bootcamp part of the cloud literacy initiative. This pilot includes curriculum, pedagogy, and software tools. Surveys were administered to the students to collect their demographic information, assessments of the pedagogical approaches and interest in cloud computing. Also, pre- and post-exam scores were reported to analyze student performance outcomes. These results are presented to show the potential of such an outreach program to build capacity and broaden participation in the computing field through emerging technology. 

   more » « less
4. Towards a Threat Model for Fog Computing

   https://doi.org/10.1109/UEMCON47517.2019.8993005  

   Karim, Yasser ; Hasan, Ragib ( October 2019 , 2019 IEEE 10th Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON))

   null (Ed.)

   In recent years, the addition of billions of Internet of Thing (IoT) device spawned a massive demand for computing service near the edge of the network. Due to latency, limited mobility, and location awareness, cloud computing is not capable enough to serve these devices. As a result, the focus is shifting more towards distributed platform service to put ample computing power near the edge of the networks. Thus, paradigms such as Fog and Edge computing are gaining attention from researchers as well as business stakeholders. Fog computing is a new computing paradigm, which places computing nodes in between the Cloud and the end user to reduce latency and increase availability. As an emerging technology, Fog computing also brings newer security challenges for the stakeholders to solve. Before designing the security models for Fog computing, it is better to understand the existing threats to Fog computing. In this regard, a thorough threat model can significantly help to identify these threats. Threat modeling is a sophisticated engineering process by which a computer-based system is analyzed to discover security flaws. In this paper, we applied two popular security threat modeling processes - CIAA and STRIDE - to identify and analyze attackers, their capabilities and motivations, and a list of potential threats in the context of Fog computing. We posit that such a systematic and thorough discussion of a threat model for Fog computing will help security researchers and professionals to design secure and reliable Fog computing systems. 

   more » « less
5. Towards a Threat Model for Fog Computing

   Karim, Md. Yasser ; Hasan, Ragib ( October 2019 , IEEE UEMCON 2019)

   In recent years, the addition of billions of Internet of Thing (IoT) device spawned a massive demand for computing service near the edge of the network. Due to latency, limited mobility, and location awareness, cloud computing is not capable enough to serve these devices. As a result, the focus is shifting more towards distributed platform service to put ample com- puting power near the edge of the networks. Thus, paradigms such as Fog and Edge computing are gaining attention from researchers as well as business stakeholders. Fog computing is a new computing paradigm, which places computing nodes in between the Cloud and the end user to reduce latency and increase availability. As an emerging technology, Fog computing also brings newer security challenges for the stakeholders to solve. Before designing the security models for Fog computing, it is better to understand the existing threats to Fog computing. In this regard, a thorough threat model can significantly help to identify these threats. Threat modeling is a sophisticated engineering process by which a computer-based system is analyzed to discover security flaws. In this paper, we applied two popular security threat modeling processes – CIAA and STRIDE – to identify and analyze attackers, their capabilities and motivations, and a list of potential threats in the context of Fog computing. We posit that such a systematic and thorough discussion of a threat model for Fog computing will help security researchers and professionals to design secure and reliable Fog computing systems. 

   more » « less