Identifying and Mitigating Phishing Attack Threats in IoT Use Cases Using a Threat Modelling Approach.

Area of Science:

• Cybersecurity
• Internet of Things (IoT)
• Threat Modeling

Background:

• The proliferation of Internet of Things (IoT) devices has introduced significant security vulnerabilities.
• Phishing attacks are increasingly targeting IoT devices, aiming to steal sensitive information and gain unauthorized control.
• Existing security measures struggle to keep pace with the evolving sophistication of these cyber threats.

Purpose of the Study:

• To propose and evaluate a novel threat modeling approach for identifying and mitigating phishing attacks in IoT environments.
• To enhance the security posture of critical IoT applications, including smart homes and autonomous vehicles.
• To provide a framework for researchers, engineers, and policymakers to proactively address IoT cybersecurity risks.

Main Methods:

• Application of the STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) threat modeling methodology.
• Analysis of two key IoT use cases: smart autonomous vehicular systems and smart home environments.
• Systematic identification of potential phishing attack vectors and vulnerabilities within these use cases.

Main Results:

• The STRIDE approach effectively identified numerous potential threats leading to phishing attacks in the considered IoT use cases.
• The threat modeling process highlighted specific vulnerabilities in smart home and autonomous vehicle systems.
• The study provides a clear understanding of attack surfaces exploitable by phishing tactics in IoT.

Conclusions:

• The proposed threat modeling approach is crucial for proactively securing IoT devices and systems against phishing threats.
• Early-stage threat identification and mitigation are essential for the secure deployment of IoT in critical infrastructures.
• This research supports the development of more robust cybersecurity strategies for the expanding IoT ecosystem.