Introduction to the Special Issue on the Lifecycle of IoT (In)security

Abstract

The editors of Digital Threats Research and Practice (DTRAP) are excited to bring readers this special issue on Internet of Things (IoT) security. Here, a diverse mixture of cybersecurity academics and industry practitioners have authored articles spanning vulnerabilities in encryption protocols, MAC-layer spoofing protection, shared IoT responsibility models, and industry issues around multimodal deployments. IoT security can be an alarming problem, as devices are often deeply embedded in our hospitals, vehicles, and infrastructure. IoT security is unique in that device manufacturers typically experience heavy downward cost-per-unit pressures, keeping the cybersecurity functionality in hardware and firmware scaled down as well. Heterogenous networks, hardware often leased in the cloud, and hyper-connected environments spanning multiple parties make cybersecurity a team sport. Today, shared responsibility models are a hot topic. The cloud industry has evolved well-defined security responsibilities between infrastructure providers, like Amazon, and tenant companies leasing infrastructure to deploy technologies within. Unfortunately, shared responsibility models around IoT ecosystems have been lacking. It is fitting that our first article, “Emerging Cybersecurity Capability Gaps in the Industrial Internet of Things: Overview and Research Agenda,” tackles the problem of a shared responsibility model in IoT. It presents an assessment of capability gaps based on a series of workshops with 100 expert participants. It presents comprehensive needs against the NIST framework and includes research that models the division of cybersecurity responsibility across the IoT device, network, and cloud resident data, impacting the full lifecycle. MAC-layer spoofing is a serious problem in wireless systems, and scaled-down IoT devices often lack any prevention and detection capabilities. “Randomized Moving Target Approach for MAC-layer Spoofing Detection and Prevention in IoT Systems” details a novel system combing signal-level device fingerprinting with the principles of Randomized Moving Target Defense (RMTD).