There are currently more objects connected to the Internet than there are people in the world. This gap will continue to grow, as more objects gain the ability to directly interface with the Internet or become physical representations of data accessible via Internet systems. This trend toward greater independent object interaction in the Internet is collectively described as the Internet of Things (IoT). As with previous global technology trends, such as widespread mobile adoption and datacentre consolidation, the changing operating environment associated with the Internet of Things represents considerable impact to the attack surface and threat environment of the Internet and Internet-connected systems. The increase in Internet-connected systems and the accompanying, non-linear increase in Internet attack surface can be represented by several tiers of increased surface complexity. Users, or groups of users, are linked to a non-linear number of connected entities, which in turn are linked to a non-linear number of indirectly connected, trackable entities. At each tier of this model, the increasing population, complexity, heterogeneity, interoperability, mobility, and distribution of entities represents an expanding attack surface, measurable by additional channels, methods, and data items. Further, this expansion will necessarily increase the field of security stakeholders and introduce new manageability challenges. This document provides a framework for measurement and analysis of the security implications inherent in an Internet that is dominated by non-user endpoints, content in the form of objects, and content that is generated by objects without direct user involvement.
[1]
Steven J. Greenwald,et al.
Proceedings of the 2001 workshop on New security paradigms
,
2001
.
[2]
Jeannette M. Wing,et al.
An Attack Surface Metric
,
2011,
IEEE Transactions on Software Engineering.
[3]
Florian Michahelles,et al.
An Architectural Approach Towards the Future Internet of Things
,
2011,
Architecting the Internet of Things.
[4]
Harrick M. Vin,et al.
Heterogeneous networking: a new survivability paradigm
,
2001,
NSPW '01.
[5]
Dave Evans,et al.
How the Next Evolution of the Internet Is Changing Everything
,
2011
.
[6]
John R. Boyd,et al.
The Essence of Winning and Losing
,
2012
.
[7]
Florian Michahelles,et al.
Architecting the Internet of Things
,
2011
.
[8]
Frank Stajano,et al.
Location Privacy in Pervasive Computing
,
2003,
IEEE Pervasive Comput..
[9]
Scott D. Applegate.
The principle of maneuver in cyber operations
,
2012,
2012 4th International Conference on Cyber Conflict (CYCON 2012).