Internet of Things (IoT) is being widely adopted in recent years. Security, however, has lagged behind, as evidenced by the increasing number of attacks that use IoT devices (e.g., an arson that uses a smart oven, burglary via a smart lock). Therefore, the transparency and accountability of those... See full abstract

Internet of Things (IoT) is being widely adopted in recent years. Security, however, has lagged behind, as evidenced by the increasing number of attacks that use IoT devices (e.g., an arson that uses a smart oven, burglary via a smart lock). Therefore, the transparency and accountability of those devices very often become questionable. To that end, formally verifying the system state of those devices against desirable security rules might be a promising solution. However, there is a significant gap between the high-level security recommendations (e.g., NISTIR 8228, NISTIR 8259, OWASP IoT guidance, UK code of practice, and ENISA good practices) for IoT, and the low-level system data (e.g., sensor data, logs, configurations) in IoT devices. This poster aims to bridge this gap and design a technique to automatically define actionable security rules based on those high-level recommendations and to enable the verification of those low-level implementations of IoT devices.
Hide full abstract