Continue # Infosys Whitepaper 
 Radio communication analysis between device and the gateway by attacking ZigBee,  zWave, 6LoWPAN Attacking Bluetooth Low Energy (BLE) Checking if device has direct connection - connecting to mobile app which is in same  network  Check for ﬁrmware Update Functionality Check if ﬁrmware Contains Sensitive Information Check if ﬁrmware update functionality is using encryption and secure communication  and update ﬁle encrypted Check for insecure or misconﬁgured services like FTP, Telnet, TFTP, Finger, SMB, e.g.  misconﬁgured NAT-PMP services, hard-coded Telnet logins Gateway (Raspberry Pi: USB) Security threats Security assessment test case L2: Insuﬃcient Authentication/ 
Authorization L3: Insecure Network Services L5: Privacy Concerns L8: Insuﬃcient Security Conﬁgurability L10:Poor Physical Security Check for Password Complexity and Password Recovery mechanism for device Check for poorly Protected Credentials and ineﬃcient two Factor Authentication Check for Role Based Access Control Check for open ports, check if there are any unnecessary ports utilized.<|endoftext|>Check if getting access to device memory to get sensitive/personal data stored, encryption  keys, certiﬁcates is allowed Check if Firmware extraction and modiﬁcation is possible Check for User or Admin Command Line Interface issues Privilege escalation Check if device can be reset to insecure state or default state Check if device or internal memory can be accessed via USB ports and SD cards External Document © 2018 Infosys Limited 

---

  Page: 7 / 8  

---

 Message broker Security threats Security assessment test case L4: Lack Of Transport Encryption Insecure Data Storage Check for sensitive data stored on Kafka as it does not support encryption of data at rest Check if conﬁguration ﬁles can be accessed and modiﬁed Cloud Interface  Security threats Security assessment test case I6: Insecure Cloud Interface OWASP Cloud Top 10 vulnerabilities Arbitrary Code Execution Check for Insuﬃcient authentication, lack of transport encryption and account enumeration  to access data or controls via the cloud website.<|endoftext|>Check if ﬁrewall is conﬁgured (if the master of the cluster is exposed to the internet without having any ﬁrewall in between  then anyone with access to the master URI can submit jobs to the cluster remotely) Check for arbitrary code execution Check for OWASP Cloud Top 10 risks R1: Accountability & Data Risk R2: User Identity Federation R3: Regulatory Compliance R4: Business Continuity & Resiliency R5: User Privacy & Secondary Usage of Data R6: Service & Data Integration R7: Multi-tenancy & Physical Security R8: Incidence Analysis & Forensics R9: Infrastructure Security R10: Non-production Environment Exposure Application-Web Interface Security threats Security assessment test case I1: Insecure Web Interface OWASP Web Top 10 vulnerabilities Check for OWASP web Top 10 issues A1:Injection A2:Broken Authentication and Session Management A3:Cross-Site Scripting (XSS) A4:Insecure Direct Object References A5:Security Misconﬁguration A6:Sensitive Data Exposure A7:Missing function level control A8:CSRF A9:Using vulnerabilities from known unknown components A10Unvalidated Redirects and Forwards External Document © 2018 Infosys Limited 

---

  Page: 8 / 8  

---

 Conclusion References: IoT is no doubt a fascinating, yet emerging technology. The prioritization of rapid  development over security by the developers has caused rise of new IoT vulnerabilities.  A large number of IoT devices have already become victims of hacks, botnets and other  attacks constantly. Proper security frameworks for IoT, like.NET, Java, Android and iOS,  should be made available. IoT solution developers must have security know how. IoT  application development should follow secure development life cycle, security tests  have to be mandatory. In addition to these, advance approaches like machine learning  can also be applied to ensure the IoT security.<|endoftext|>1. http://www.forbes.com/sites/thomasbrewster/2014/11/07/car-safety-tool-could-have-given-hackers-control-of-your-vehicle/#2b98d1ef21b0 2. http://www.computerworld.com/article/2487425/cybercrime-hacking/target-breach-happened-because-of-a-basic-network-segmentation-error.html 3. http://www.ey.com/Publication/vwLUAssets/EY-cybersecurity-and-the-internet-of-things/$FILE/EY-cybersecurity-and-the-internet-of-things.pdf  4. http://h30499.www3.hp.com/t5/Fortify-Application-Security/HP-Study-Reveals-70-Percent-of-Internet-of-Things-Devices/ba-p/6556284#.VHMpw4uUfVc  5. http://www.ey.com/Publication/vwLUAssets/EY-cybersecurity-and-the-internet-of-things/$FILE/EY-cybersecurity-and-the-internet-of-things.pdf  6. http://www2.deloitte.com/content/dam/Deloitte/global/Documents/Technology-Media-Telecommunications/gx-tmt-Iotecosystem.pdf  7. http://internetofthingsagenda.techtarget.com/info/getstarted/Internet-of-Things-IoT-Security-Threats  8. http://internetofthingswiki.com/iot-trends-in-2016/300/  9. http://internetofthingswiki.com/iot-trends-in-2016/300/   10.https://iotsecuritywiki.com/ About the authors •   Amitesh Gaurav is the Systems Engineer working with Infosys Center for Emerging Technology Solutions group. He works as Security  analyst. His focus areas are Web, Mobile and IOT Application security assurance.<|endoftext|>•   Jayaprakash Govindaraj is the Senior Technology Architect, and leads Security CoE at Infosys Center for Emerging Technology Solutions  group. His focus areas are Web, Mobile and IOT Applications Security Assurance, Secure Development and Managed Security Services.<|endoftext|>Application-Web Interface Security threats Security assessment test case I7: Insecure Mobile Interface OWASP Mobile Top 10 vulnerabilities Check for OWASP Mobile Top 10 issues M1: Weak Server Side Controls   M2: Insecure Data Storage   M3: Insuﬃcient Transport Layer Protection   M4: Unintended Data Leakage   M5: Poor 
Authorization and Authentication   M6: Broken Cryptography   M7: Client Side Injection   M8: Security Decisions Via Untrusted Inputs   M9: Improper Session Handling   M10: Lack of Binary Protections  © 2018 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys  acknowledges the proprietary rights of other companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this  documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, printing, photocopying, recording or otherwise, without the  prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.  For more information, contact askus@infosys.com Infosys.com | NYSE: INFY Stay Connected   


***


  