Internet of Things Security

Short description

The Internet of Things (IoT) is growing quickly. Ever more devices are being connected to the Internet to make them easier to use and for automation purposes. Refrigerators are automatically re-ordering milk, an update will teach our cars to drive themselves, whilst bridges send live updates on their structural integrity.

IoT means connecting physical devices with the virtual world. The rapid development of hardware and software, network protocols as well as the incorporation of devices in our day-to-day lives creates a large attack surface culminating in an abundance of security holes and vulnerabilities.

This seminar not only highlights the technical fundamentals and network protocols, but, above all, also uses practical examples to highlight the security of these standards. Compass equips you in this course with the skills you need to securely design, evaluate and operate IoT devices. 

The exercises will be done on www.hacking-lab.com. Following the course, the labor environment is available to the participants for 30 more days.


Learning objectives

Participants will learn the fundamental components of the Internet of Things and be able to recognize what attack vectors exist. This applies equally to hardware, firmware and software components as well as to network protocols and architecture. You'll then be able to evaluate the use of IoT systems according to security criteria


Highlights 

  • Penetration tests
    • Attack Surface Analysis
    • Local/Remote Attacks
  • Web Security (OWASP Top 10)
    • XSS
    • SQL Injection
    • Authentication
    • CSRF
  • Communication protocols
    • HTTP
    • TLS
    • MQTT
    • IoTivity
  • Wireless Technologies
    • ZigBee
    • LoRaWAN (Long Range Wide Area Network)
    • Bluetooth (BLE)
  • Cryptography
    • Pseudo Random Number Generators
    • Encryption and Integrity
    • Key Distribution
  • Security of Firmware
    • OS-level Security Using Linux
    • Securely distributing your firmware
  • Hardware Security
    • Physical Integrity
    • UART/JTAG

 

Demarcation: Due to the broad spectrum of the topics covered in this course only the fundamentals and illustrative attack scenarios for the protocols and technologies chosen will be explained and demonstrated. This enables participants to transfer what they've learnt to additional protocols and computer architectures.


Target group

  • Security- and Risk Officers
  • Developers of applications who integrate IoT protocols
  • IoT architecture designers und integrators
  • Manufacturers and developers of IoT devices


Prerequisite

  • Familiarity with the Linux command line
  • Knowledge of networking fundamentals
  • Knowledge of programming is helpful, but not required

    CALENDAR

    Cyber Risks - Früherkennung leicht gemacht

    Das SwissBoardForum lädt ein zum Spezialevent «Cyber Risks». Ivan Bütler zeigt in seinem Live Hacking, welchen Risiken unsere Infrastruktur gegenüber... Read more

    Beer-Talk in Zürich: Bluetooth Low Energy: Protocol, Security & Attacks

    Immer mehr Geräte und Gadgets können über Bluetooth Low Energy (BLE) miteinander kommunizieren. Haben Sie sich schon gefragt, was dieses BLE überhaupt... Read more

    Security Training: Secure Mobile Apps

    In the 2-day course (in German) from Mai 12/13, 2020, you will learn about the most important security problems of mobile apps. Read more

    ALL DATES

    NEWS

    Vulnerability in Abacus

    Ville Koch identified a Cross-Site Scripting vulnerability in Abacus. Read more

    Rein kommen wir meistens

    In einem Interview in der Wirtschaftszeitung «Finanz und Wirtschaft» spricht Walter Sprenger über die Motivationsgründe und Methoden der Hacker. Read more

    KMU im Visier von Cyberkriminellen

    In der Sendung «Fokus KMU» erzählt ein Betroffener über die Auswirkungen der Cyber Attacke auf sein Unternehmen. Cyrill Brunschwiler von Compass... Read more

    ARCHIVES

    Compass Security Blog

    New SMBGhost Vulnerability Affects Modern Windows Systems

    A new vulnerability (CVE-2020-0796) affecting SMBv3 has been discovered. The community has started to name this vulnerability SMBGhost because everyone knows this vulnerability is present but no... mehr

    Domain-Join Computers the Proper Way

    When you add a new computer, it must first join the domain. If you use its future main user to do it, they'll become the owner and be able to hijack the computer to become a local administrator in... mehr

    ZUM BLOG