Bizi tercih ettiğiniz için teşekkür ederiz. Ekip üyelerimiz en kısa sürede sizlerle iletişime geçecektir.
Rezervasyonunuzu gönderdiğiniz için teşekkür ederiz! Ekibimizden bir yetkili kısa süre içinde sizinle iletişime geçecektir.
Eğitim İçeriği
Session 1 & 2: Basic and Advanced concepts of IoT architecture from security perspective
- A brief history of the evolution of IoT technologies.
- Data models in IoT systems – definition and architecture of sensors, actuators, devices, gateways, and communication protocols.
- Third-party devices and risks associated with vendor supply chains.
- The technology ecosystem – device providers, gateway providers, analytics providers, platform providers, and system integrators, along with the risks associated with each.
- Edge-driven distributed IoT vs. Cloud-driven central IoT: Advantages versus risk assessment.
- Management layers in IoT systems – fleet management, asset management, sensor onboarding/deboarding, digital twins, and risks related to authorization in management layers.
- Demo of IoT management systems including AWS, Microsoft Azure, and other fleet managers.
- Introduction to popular IoT communication protocols – Zigbee, NB-IoT, 5G, LoRa, Wi-SUN – and a review of vulnerabilities in communication protocol layers.
- Understanding the entire IoT technology stack with a review of risk management.
Session 3: A check-list of all risks and security issues in IoT
- Firmware patching – the soft underbelly of IoT.
- Detailed review of IoT communication protocol security: Transport layers (NB-IoT, 4G, 5G, LoRa, Zigbee, etc.) and Application Layers (MQTT, WebSockets, etc.).
- API endpoint vulnerabilities – a list of all possible APIs in IoT architecture.
- Vulnerabilities of gateway devices and services.
- Vulnerabilities of connected sensors and gateway communication.
- Vulnerabilities of gateway/server communication.
- Vulnerabilities of cloud database services in IoT.
- Vulnerabilities of application layers.
- Vulnerabilities of gateway management services (local and cloud-based).
- Risks associated with log management in edge and non-edge architectures.
Session 4: OWASP Model of IoT security, Top 10 security risks
- I1 Insecure Web Interface
- I2 Insufficient Authentication/Authorization
- I3 Insecure Network Services
- I4 Lack of Transport Encryption
- I5 Privacy Concerns
- I6 Insecure Cloud Interface
- I7 Insecure Mobile Interface
- I8 Insufficient Security Configurability
- I9 Insecure Software/Firmware
- I10 Poor Physical Security
Session 5: Review and Demo of AWS-IoT and Azure IoT security principles
- Microsoft Threat Model – STRIDE
Details of STRIDE Model
- Securing device, gateway, and server communication – Asymmetric encryption.
- X.509 certification for public key distribution.
- SAS Keys.
- Bulk OTA risks and techniques.
- API security for application portals.
- Deactivation and disconnection of rogue devices from the system.
- Vulnerabilities in AWS/Azure security principles.
Session 6: Review of evolving NIST standards/recommendations for IoT
Review of NISTIR 8228 standard for IoT security – 30-point risk consideration model.
Third-party device integration and identification.
- Service identification & tracking.
- Hardware identification & tracking.
- Communication session identification.
- Management transaction identification and logging.
- Log management and tracking.
Session 7: Securing Firmware/Device
Securing debugging mode in firmware.
Physical security of hardware.
- Hardware cryptography – PUF (Physically Unclonable Function) for securing EPROM.
- Public PUF, PPUF.
- Nano PUF.
- Known classification of malware families in firmware (18 families according to YARA rule).
- Study of popular firmware malware – MIRAI, BrickerBot, GoScanSSH, Hydra, etc.
Session 8: Case Studies of IoT Attacks
- On Oct. 21, 2016, a massive DDoS attack targeted Dyn DNS servers, shutting down many web services including Twitter. Hackers exploited default passwords and usernames of webcams and other IoT devices, installing the Mirai botnet on compromised devices. This attack will be studied in detail.
- IP cameras can be hacked through buffer overflow attacks.
- Philips Hue lightbulbs were hacked via their ZigBee link protocol.
- SQL injection attacks were effective against Belkin IoT devices.
- Cross-site scripting (XSS) attacks exploited the Belkin WeMo app to access data and resources.
Session 9: Securing Distributed IoT via Distributed Ledger – Blockchain and DAG (IOTA) [3 hours]
Distributed ledger technology – DAG Ledger, Hyperledger, Blockchain.
PoW, PoS, Tangle – a comparison of consensus methods.
- Differences between Blockchain, DAG, and Hyperledger – a comparison of working mechanisms, performance, and decentralization.
- Real-time and offline performance of different DLT systems.
- P2P network, private and public key basics.
- Practical implementation of ledger systems – review of research architectures.
- IOTA and Tangle – DLT for IoT.
- Practical application examples from smart cities, smart machines, and smart cars.
Session 10: Best practice architecture for IoT security
- Tracking and identifying all services in gateways.
- Avoid using MAC addresses; use package IDs instead.
- Use an identification hierarchy for devices – board ID, Device ID, and package ID.
- Structure firmware patching to perimeter and conform to service ID.
- Utilize PUF for EPROM.
- Secure risks of IoT management portals/applications with two layers of authentication.
- Secure all APIs – define API testing and API management.
- Identify and integrate the same security principles in the logistics supply chain.
- Minimize patch vulnerabilities in IoT communication protocols.
Session 11: Drafting IoT security Policy for your organization
- Define the lexicon of IoT security and tensions.
- Suggest best practices for authentication, identification, and authorization.
- Identification and ranking of critical assets.
- Identification of perimeters and isolation for applications.
- Policy for securing critical assets, critical information, and privacy data.
Kurs İçin Gerekli Önbilgiler
- Fundamental knowledge of devices, electronic systems, and data systems.
- Basic understanding of software and systems.
- Basic comprehension of Statistics (at an Excel proficiency level).
- Understanding of Telecommunication Verticals.
Summary
- An advanced training program addressing the current state-of-the-art in Internet of Things (IoT) security.
- Covers all aspects of security related to firmware, middleware, and IoT communication protocols.
- Provides a comprehensive 360-degree overview of security initiatives within the IoT domain for those unfamiliar with IoT standards, evolution, and future trends.
- Offers an in-depth exploration of security vulnerabilities in firmware, wireless communication protocols, and device-to-cloud communications.
- Integrates multiple technology domains to foster awareness of security within IoT systems and their components.
- Includes live demonstrations of security aspects concerning gateways, sensors, and IoT application clouds.
- Explains the 30 principle risk considerations outlined in current and proposed NIST standards for IoT security.
- Reviews the OSWASP model for IoT security.
- Provides detailed guidelines for drafting IoT security standards tailored to organizational needs.
Target Audience
Engineers, managers, and security experts tasked with developing IoT projects or auditing and reviewing security risks.
21 Saatler
Danışanlarımızın Yorumları (1)
Eğitmenin ne kadar dost canlısı olduğunu. Esnekliği ve sorularıma cevap vermesi.
Saed El-kayed - International Committee of the Red Cross (ICRC)
Eğitim - IoT Security
Yapay Zeka Çevirisi
