This document discusses security issues in Internet of Things (IoT). It begins with an introduction to IoT, explaining how IoT works and its key features such as connectivity, analytics, integration and artificial intelligence. It then discusses security layers in IoT, including perception, network, application and support layers. It outlines common security threats at each layer like eavesdropping, denial of service attacks, and malware. The document also covers IoT security challenges, advantages and disadvantages of IoT.

1. SECURITY IN IOT
Seminar Report

2. CHAPTER 1
INTRODUCTION
1.1 WHAT IS AN INTERNET OF THINGS (IOT)
The term "Things" in the Internet of Things refers to anything and
everything in day to day life which is accessed or connected through the
internet.
IoT is an advanced automation and analytics system which deals with
artificial intelligence, sensor, networking, electronic, cloud messaging
etc. to deliver complete systems for the product or services. The system
created by IoT has greater transparency, control, and performance
FIG 1
FIG 2
If there is a common platform where all these things can connect to each
other would be great because based on my preference, I can set the room
temperature. For example, if I love the room temperature to to be set at
25 or 26-degree Celsius when I reach back home from my office, then

3. according to my car location, my AC would start before 10 minutes I
arrive at home. This can be done through the Internet of Things (IoT)

4. 1.2 HOW DOES INTERNET OF THING (IOT) WORK?
The working of IoT is different for different IoT echo system
(architecture). However, the key concept of there working are similar.
The entire working process of IoT starts with the device themselves,
such as smartphones, digital watches, electronic appliances, which
securely communicate with the IoT platform. The platforms collect and
analyze the data from all multiple devices and platforms and transfer the
most valuable data with applications to devices.
FIG 3
1.3 FEATURES OF IOT
The most important features of IoT on which it works are connectivity,
analyzing, integrating, active engagement, and many more. Some of
them are listed below:
Connectivity: Connectivity refers to establish a proper connection
between all the things of IoT to IoT platform it may be server or cloud.
After connecting the IoT devices, it needs a high speed messaging
between the devices and cloud to enable reliable, secure and bi-
directional communication.
Analyzing: After connecting all the relevant things, it comes to real-time
analyzing the data collected and use them to build effective business

5. intelligence. If we have a good insight into data gathered from all these
things, then we call our system has a smart system.
Integrating: IoT integrating the various models to improve the user
experience as well.
Artificial Intelligence: IoT makes things smart and enhances life
through the use of data. For example, if we have a coffee machine whose
beans have going to end, then the coffee machine itself order the coffee
beans of your choice from the retailer.
Sensing: The sensor devices used in IoT technologies detect and
measure any change in the environment and report on their status. IoT
technology brings passive networks to active networks. Without sensors,
there could not hold an effective or true IoT environment.
Active Engagement: IoT makes the connected technology, product, or
services to active engagement between each other.
Endpoint Management: It is important to be the endpoint management
of all the IoT system otherwise, it makes the complete failure of the
system. For example, if a coffee machine itself order the coffee beans
when it goes to end but what happens when it orders the beans from a
retailer and we are not present at home for a few days, it leads to the
failure of the IoT system. So, there must be a need for endpoint
management.

6. FIG 4

7. CHAPTER 2
LAYERS AND CHALLANGES
2.1 SECURITY LAYERS
“The quality or state of being secure—to be free from danger”
A successful organization should have multiple layers of security in
place:
1. Physical security
2. Personal security
3. Operations security
4. Communications security
5. Network security
6. Information security
FIG 5

8. TABLE 1

9. 2.2 SECURITY ISSUES AND CHALANGES
IOT SECURITY CHALLENGES
IoT is wonderful in many ways. But unfortunately, technology has not
matured yet, and it is not entirely safe. The entire IoT environment,
from manufacturers to users, still have many security challenges of IoT
to overcome, such as:
➢ Manufacturing standards
➢ Update management
➢ Physical hardening
➢ Users knowledge and awareness
FIG 6

10. FIG 7

11. TOP IOT SECURITY ISSUES
Lack Of Compliance On The Part Of IoT Manufacturers
The primary source of most IoT security issues is that manufacturers do
not spend enough time and resources on security
The following are some security risks in IoT devices from
manufacturers:
1. Weak, guessable, or hard-coded passwords
2. Hardware issues
3. Lack of a secure update mechanism
4. Old and unpatched embedded operating systems and
software
5. Insecure data transfer and storage
Lack Of User Knowledge & Awareness
Tricking a human is, most of the time, the easiest way to gain access to a
network. A type of IoT security risk that is often overlooked is social
engineering attacks. Instead of targeting devices, a hacker targets a
human, using the IoT.
IoT Security Problems In Device Update Management
Updates are critical for maintaining security on IoT devices. They
should be updated right after new vulnerabilities are discovered. Still,
as compared with smartphones or computers that get automatic updates,
some IoT devices continue being used without the necessary updates.

12. Lack Of Physical Hardening
The lack of physical hardening can also cause IoT security issues.
Although some IoT devices should be able to operate autonomously
without any intervention from a user, they need to be physically secured
from outer threats. Sometimes, these devices can be located in remote
locations for long stretches of time, and they could be physically
tampered with, for example, using a USB flash drive with Malware.
Botnet Attacks
A single IoT device infected with malware does not pose any real threat;
it is a collection of them that can bring down anything. To perform a
botnet attack, a hacker creates an army of bots by infecting them with
malware and directs them to send thousands of requests per second to
bring down the target.
Industrial Espionage & Eavesdropping
If hackers take over surveillance in at location by infecting IoT devices,
spying might not be the only option. They can also perform such attacks
to demand ransom money.
Thus, invading privacy is another prominent IoT security issue.
Spying and intruding through IoT devices is a real problem, as a lot of
different sensitive data may be compromised and used against its owner.
Highjacking Your IoT Devices
Ransomware has been named as one of the nastiest malware types ever
existed. Ransomware does not destroy your sensitive files — it blocks
access to them by way of encryption. Then, the hacker who infected the
device will demand a ransom fee for the decryption key unlocking the
files.

13. Data Integrity Risks Of IoT Security In Healthcare
Most IoT devices extract and collect information from the external
environment.
A hacker can gain access to a medical IoT device, gaining control
over it and being able to alter the data it collects. A controlled
medical IoT device can be used to send false signals, which in turn can
make health practitioners take actions that may damage the health of
their patients.
Rogue IoT Devices
One of the most significant IoT security risks and challenges is being
able to manage all our devices and close the perimeter.
But rogue devices or counterfeit malicious IoT devices are beginning
to be installed in secured networks without authorization. A rogue
device replaces an original one or integrates as a member of a group to
collect or alter sensitive information. These devices break the network
perimeter.
Cryptomining With IoT Bots
Mining cryptocurrency demands colossal CPU and GPU resources, and
another IoT security issue has emerged due to this precondition —
crypto mining with IoT bots. This type of attack involves infected
botnets aimed at IoT devices, with the goal not to create damage, but
mine cryptocurrency.

14. FIG 8

15. CHAPTER 3
SECURITY ARCHITECTURE
FIG 9

16. 3.1 PERCEPTION LAYER
It is also known as a sensor layer. It works like people’s eyes, ears and
nose. It has the responsibility to identify things and collect the
information from them. There are many types of sensors attached to
objects to collect information such as RFID, 2-D barcode and sensors.
The sensors are chosen according to the requirement of applications. The
information that is collected by these sensors can be about location,
changes in the air, environment, motion, vibration, etc. However, they
are the main target of attackers who wish to utilize them to replace the
sensor with their own. Therefore, the majority of threats are related to
sensors Common security threats of perception layer are:
• Eavesdropping: Eavesdropping is an unauthorized real-time attack
where private communications, such as phone calls, text messages,
fax transmissions or video conferences are intercepted by an
attacker. It tries to steal information that is transmitted over a
network. It takes advantage of unsecure transmission to access the
information being sent and received.
• Node Capture: It is one of the hazardous attacks faced in the
perception layer of IoT. An attacker gains full control over a key
node, such as a gateway node. It may leak all information
including communication between sender and receiver, a key used
to make secure communication and information stored in memory
• Fake Node and Malicious: It is an attack in which an attacker adds
a node to the system and inputs fake data. It aims to stop
transmitting real information. A node added by an attacker
consumes precious energy of real nodes and potentially control in
order to destroy the network.
• Replay Attack: It is also known as a play back attack. It is an
attack in which an intruder eavesdrops on the conservation
between sender and receiver and takes authentic information from
the sender. An intruder sends same authenticated information to
the victim that had already been received in his communication by

17. showing proof of his identity and authenticity. The message is in
encrypted form, so the receiver may treat it as a correct request and
take action desired by the intruder
• Timing Attack: It is usually used in devices that have weak
computing capabilities. It enables an attacker to discover
vulnerabilities and extract secrets maintained in the security of a
system by observing how long it takes the system to respond to
different queries, input or cryptographic algorithms
3.2 NETWORK LAYER
Network layer is also known as transmission layer. It acts like a bridge
between perception layer and application layer. It carries and transmits
the information collected from the physical objects through sensors. The
medium for the transmission can be wireless or wire based. It also takes
the responsibility for connecting the smart things, network devices and
networks to each other. Therefore, it is highly sensitive to attacks from
the side of attackers. It has prominent security issues regarding integrity
and authentication of information that is being transported in the
network. Common security threats and problems to network layers are:
• Denial of Service (DoS) Attack: A DoS attack is an attack to
prevent authentic users from accessing devices or other network
resources. It is typically accomplished by flooding the targeted
devices or network resources with redundant requests in an order
to make it impossible or difficult for some or all authentic users to
use them
• Main-in-The-Middle (MiTM) Attack: MiTM attack is an attack
where the attacker secretly intercepts and alters the communication
between sender and receiver who believe they are directly
communicating with each other. Since an attacker controls the
communication, therefore he or she can change messages
according to their needs. It causes a serious threat to online
security because they give the attacker the facility to capture and
manipulate information in real time

18. • Storage Attack: The information of users is stored on storage
devices or the cloud. Both storage devices and cloud can be
attacked by the attacker and user’s information may be changed to
incorrect details. The replication of information associated with the
access of other information by different types of people provides
more chances for attacks.
• Exploit Attack: An exploit is any immoral or illegal attack in a
form of software, chunks of data or a sequence of commands. It
takes advantage of security vulnerabilities in an application,
system or hardware. It usually comes with the aim of gaining
control of the system and steals information stored on a network
3.3 APPLICATION LAYER
Application layer defines all applications that use the IoT technology or
in which IoT has deployed. The applications of IoT can be smart homes,
smart cities, smart health, animal tracking, etc. It has the responsibility
to provide the services to the applications. The services may be varying
for each application because services depend on the information that is
collected by sensors. There are many issues in the application layer in
which security is the key issue. In particular, when IoT is used in order
to make a smart home, it introduces many threats and vulnerabilities
from the inside and outside. To implement strong security in an IoT
based smart home, one of the main issues is that the devices used in
smart homes have weak computational power and a low amount of
storage such as ZigBee [44]. Common security threats and problem of
application layer are:
• Cross Site Scripting: It is an injection attack. It enables an attacker
to insert a client-side script, such as java script in a trusted site
viewed other users. By doing so, an attacker can completely
change the contents of the application according to his needs and
use original information in an illegal way [45].

19. • Malicious Code Attack: It is a code in any part of software
intended to cause undesired effects and damage to the system. It is
a type of threat that may not be blocked or controlled by the use of
anti-virus tools. It can either activate itself or be like a program
requiring a user’s attention to perform an action.
• The ability of dealing with Mass Data: Due to a large number of
devices and a massive amount of data transmission between users,
it has no ability to deal with data processing according to the
requirements. As a result, it leads to network disturbance and data
loss.
3.4 SUPPORT LAYER
The reason to make a fourth layer is the security in architecture of IoT.
Information is sent directly to the network layer in three-layer
architecture. Due to sending information directly to the network layer,
the chances of getting threats increase. Due to flaws that were available
in three-layer architecture, a new layer is proposed. In four-layer
architecture, information is sent to a support layer that is obtained from a
perception layer. The support layer has two responsibilities. It confirms
that information is sent by the authentic users and protected from threats.
There are many ways to verify the users and the information. The most
commonly used method is the authentication. It is implemented by using
pre-shared secrets, keys and passwords. The second responsibility of the
support layer is sending information to the network layer. The medium
to transmit information from the support layer to network layer can be
wireless and wire based. There are various attacks that can affect this
layer such as DoS attack, malicious insider, unauthorized access, etc.
Common threats and problems of the support layer are:
• DoS Attack: The DoS attack in a support layer is related to the
network layer. An attacker sends a large amount of data to make
network traffic inundated. Thus, the massive consumption of
system resources exhausts the IoT and makes the user not capable
of accessing the system.

20. • Malicious Insider Attack: It occurs from the inside of an IoT
environment to access the personal information of users. It is
performed by an authorized user to access the information of other
user. It is a very different and complex attack that requires
different mechanisms to prevent the threat

21. CHAPTER 4
ADVANTAGES AND DISADVANTAGES OF (IOT)
Any technology available today has not reached to its 100 % capability.
It always has a gap to go. So, we can say that Internet of Things has a
significant technology in a world that can help other technologies to
reach its accurate and complete 100 % capability as well.
Let's take a look over the major, advantages, and disadvantages of the
Internet of Things.
4.1 ADVANTAGES OF IOT
Internet of things facilitates the several advantages in day-to-day life in
the business sector. Some of its benefits are given below:
• Efficient resource utilization: If we know the functionality and the
way that how each device work we definitely increase the efficient
resource utilization as well as monitor natural resources.
• Minimize human effort: As the devices of IoT interact and
communicate with each other and do lot of task for us, then they
minimize the human effort.
• Save time: As it reduces the human effort then it definitely saves
out time. Time is the primary factor which can save through IoT
platform.
• Enhance Data Collection:
• Improve security: Now, if we have a system that all these things
are interconnected then we can make the system more secure and
efficient.

22. 4.2 DISADVANTAGES OF IOT
As the Internet of things facilitates a set of benefits, it also creates a
significant set of challenges. Some of the IoT challenges are given
below:
o Security: As the IoT systems are interconnected and communicate
over networks. The system offers little control despite any security
measures, and it can be lead the various kinds of network attacks.
o Privacy: Even without the active participation on the user, the IoT
system provides substantial personal data in maximum detail.
o Complexity: The designing, developing, and maintaining and
enabling the large technology to IoT system is quite complicated.
4.3 CONCLUSION
• As IoT becomes more pervasive, edge computing will do the same.
• The ability to analyze data closer to the source will minimize
latency, reduce the load on the internet, improve privacy and
security, and lower data management costs.
• The cloud will continue to play a critical role in aggregating
important data and performing analyses on this massive set of
information to glean insights that can be distributed back to the
edge devices.
• The combination of edge and cloud computing will help you better
manage and analyze your data and significantly increase the value
of your IoT efforts

23. 4.4 REFERENCES :
• https://www.eurofins-cybersecurity.com/news/security-problems-
iot-devices/
• https://www.javatpoint.com/iot-internet-of-things