IoT Pentesting
Process
Risk assessment is dependent on customer specific security requirements. It starts right from sensor and devices till IoT application covering entire network and IT infrastructure. Every software and hardware component is required to be evaluated for secured IoT system after deployment. Individual OEMs can choose their respective components for vulnerability assessment before deployment in the integrated environment.
Scope definition
Defining the boundaries of assessment helps to set the objectives, identify the attack vectors, inclusions & exclusions, timeline and testing approach.
Vulnerability assessment & penetration testing
We use automated tools as well as manual methods for vulnerability scanning and penetration testing of network, applications, mobile applications, IoT sensors, devices & its firmware. We provide gap analysis with risk prioritization and severity level along with recommended solution to fix the gaps. The report is prepared based on OWASP IoT top 10 standard.
System hardening & configuration review
System hardening is a best practice to reduce the attack surface for all networked devices like servers, workstations and other network devices. Along with the hardware, the operating system software is also assessed for potential threats and the technique is applied to minimize the unneeded services & packages. Firewall is audited for its configuration and rules as per security requirement. We apply OWASP hardening standard to ensure security lockdown.
Code Review
Many times the vulnerabilities related to the code development for applications and firmware of embedded devices get exposed only after the deployment. Our tech experts work with the development teams of the customer during development stage itself to help develop the code which is secure prior to the deployment on the network.
Compliance Audits
A security compliance audit is comprehensive third party review of the organization for its readiness & adherence to cyber security processes and best practices. Compliance audits provide organizations an opportunity to continuously improve its risk management capability. Some of the compliances are regulatory in nature and are mandatory as per laws and regulations of specific country while some provides strong foundation for cyber risk assessment & security management. Valency Networks has been providing implementation consultancy and audit services for major information security compliances such as ISO 27001, ISO 27017/18, HIPAA, GDPR, SOC 2, PCI DSS, ITAR and FDA CFR Part 11 & 820.
ICS/SCADA Security Assessment
Industrial control systems popularly known as SCADA & DCS are part of operational technology (OT) and are considered as critical infrastructure for any industry. IT-OT convergence has brought these systems in forefront from the security stand point as these systems are not designed by security. With exposure of ICS network to corporate network and internet, these systems have become more vulnerable to network and physical attacks.
The potential threat to the ICS systems inflicts very high cost to capital investment, huge production loss and danger to human lives. While assessing the risks for ICS systems, there is a need to treat these systems differently than any other IT system. Valency Networks? domain expertise helps industry to assess the system & network vulnerabilities and manage the risks to strengthen the network & physical security of the ICS system by conducting vulnerability assessment, penetration testing and ICS security audits on specific parameters applicable for ICS environment.
Deliverables
Valency Networks has unique approach to risk assessment and reporting.
Every technical assessment is based on automated tools, custom built scripts & manual testing.
The report is generated based on OWASP top 10 & CWE 25 standard.
Compliance Audits for various industry standards & regulations.
Prioritization of Risks/vulnerabilities according to threat level.
Recommended solution to fix the gap for all vulnerabilities.
Documentation as per requirements of standards & regulation.
Audit report comprising of gap analysis and solutions.
Is IoT a target for hackers?
Over 300,000 malware attacks on Internet of Things (IoT) devices are identified in the analysis for cyberattacks.
What type of encryption is used in IoT?
Many IoT devices use symmetric encryption, in which a single key gets used to encrypt and decrypt data. The fact that the data gets encrypted offers a secure layer of security, particularly compared to using hardcoded or default passwords, but sharing and storing the encryption key creates risk.
What are the most hacked devices?
Smart hubs account for 15% and “network-attached” storage devices for 12% of commonly hacked IOT items found in the home or office. The remainder belongs to printers, smart TVs, and IP Phones that are commonly used and provide success in hacking attempts.
What are some of the biggest security vulnerabilities that come with IoT?
The Most Important Security Problems with IoT Devices
- Incorrect access control
- Overly large attack surface
- Outdated software
- Lack of encryption
- Application vulnerabilities
- Lack of Trusted Execution Environment
- Vendor security posture
- Insufficient privacy protection
- Intrusion ignorance
- Insufficient physical security
- User interaction
Why do you think IoT cybersecurity is important for IoT manufacturers?
While increased adoption has given wings to IoT growth, the core industry is really concerned about the security and privacy concerns surrounding this platform. Since many of these devices work primarily as trackers and monitors, the primary function is to send back data at regular intervals sometimes in seconds. This becomes a considerable amount of data size over a larger duration say weeks or months. Also, with the minimalistic embedded computing devices capabilities in IoT devices, placing complicated security tools or technologies becomes impossible.
What is an attack surface?
Attack surface refers to the exposed areas or vulnerabilities in the IoT device that can be exploited by a malicious hacker to gain unauthorized access.
Which is the commonly used security standard reference for IoT cybersecurity?
The most commonly used IoT cybersecurity standard is by OWASP. The Top 10 vulnerabilities given by OWASP are as-
- I1: Weak Guessable, or Hardcoded Passwords
- I2: Insecure Network Services
- I3: Insecure Ecosystem Interfaces
- I4: Lack of Secure Update Mechanism
- I5: Use of Insecure or Outdated Components
- I6: Insufficient Privacy Protection
- I7: Insecure Data Transfer and Storage
- I8: Lack of Device Management
- I9: Insecure Default Settings
- I10: Lack of Physical Hardening
What type of issues comes under Insecure Ecosystem Interfaces?
Any vulnerable web interface, mobile, cloud interface, or API may be a component of insecure ecosystem interfaces. The list of issues under this category is as follows-
- Authentication issue while accessing sensitive data
- Server certificates not validated by device
- Security updates not installed
- Leaking API keys
What are the possible test cases of the secure update mechanism of IoT devices?
Possible test cases to test the update mechanisms of IoT devices:
- Check for firmware validation while updating
- Check for mechanisms to prevent rollback to the previous version
- Check for delivery of firmware is encrypted or not
- Check for vulnerabilities in the updated firmware
What is Intrusion Detection?
Intrusion Detection is the process of finding out an external influence trying to gain illegal access to the software. As its name implies, any form of unlawful access is discovered and reported for necessary action to be taken against the intrusion. It’s like the technology that detects burglary and sounds the alarm. During penetration testing, the company will automatically determine whether the intrusion detection technology in its software is functioning correctly.
Suggest a few ways to solve IoT vulnerabilities and protect devices?
Ways to protect IoT devices are-
- Change passwords frequently and use strong passwords
- Don’t rely on cloud technology
- Avoid universal plug and play features
- Use secondary network
- Update your IoT device regularly
What are the types of IoT attacks?
Attacks are defined by the layer of the IoT infrastructure targeted but can be generalized into the following categories as IoT infrastructure isn’t standardized.
- Physical – tend to target the sensor layer and require close proximity to the device.
- Network – usually the most common, can be used to extract large amounts of data remotely.
- Encrypted – devices don’t always feature encryption which makes them vulnerable to this type of attack.
- Software – the biggest risk as the potential to access the entire software system is high. Attackers might use phishing, malware, viruses, and scripts among others.
How does the IoT influence security?
Threats to IoT systems and devices translate to bigger security risks because of certain characteristics that the underlying technology possesses. These characteristics make IoT environments functional and efficient, but they are likely to be abused by threat actors.
These characteristics include:
- Gathering of abundant data
- Connection of virtual and physical environments
- Creation of complex environments
- Centralization of architecture
What are some of the attack surface areas of the IoT?
The attack surfaces could be-
- Devices- Devices can be the primary means by which attacks are initiated. Parts of a device where vulnerabilities can come from are its memory, firmware, physical interface, web interface, and network services. Attackers can also take advantage of insecure default settings, outdated components, and unsecure update mechanisms, among others.
- Communication channels- Protocols used in IoT systems can have security issues that can affect the entire system. IoT systems are also susceptible to known network attacks such as denial of service (DoS) and spoofing.
- Applications and software- Vulnerabilities in web applications and related software for IoT devices can lead to compromised systems.
What is the common vulnerability with passwords?
Passwords are one of the most vulnerable forms of user authentication. We can see this in practice when we look at how they're put to use. Oftentimes users may reuse the same password across multiple websites, which means that if an attacker manages to break into one of their accounts, they can compromise all of them.
What Our Customers Say?
Valency Networks is a very techie company, focusing on a continuous improvement in service quality. Our customers like us exactly for that and that helps us keep our quality to the best extent.
Valency Networks is our only preferred vendor because the way they find vulnerabilities in our network is par excellence. We hired them on a long term contract to top up our perimeter and wish to continue with them.
Hardly goes a day when I have not learnt anything new in cyber security space and IT technologies.
Working at Valency Networks helps me gain great knowledge everyday.