I think, IOT itself is not your theses subject matter. You can choose several typical IOT configurations and focus on their vulnerabilities and threat analyses. As you know a vulnerability isn't necessarily a threat, and not every threat is a significant risk factor.

So that, it seems to me your goal should be on a vulnerabilities analyses, then a respective threat analyses, and eventually analyses of risk factors. The specific issues you'll deal with would be related to the fact that security policies for different IOT types could be different, as well as security standards.

You may want to dig into that area and analyze their influence on eventual risk factor analyses, etc.

I think, IOT itself is not your theses subject matter. You can choose several typical IOT configurations and focus on their vulnerabilities and threat analyses. As you know a vulnerability isn't necessarily a threat, and not every threat is a significant risk factor.

So that, it seems to me your goal should be on a vulnerabilities analyses, then a respective threat analyses, and eventually analyses of risk factors. The specific issues you'll deal with would be related to the fact that security policies for different IOT types could be different, as well as security standards.

You may want to dig into that area and analyze their influence on eventual risk factor analyses, etc.

Dear Osama,

the appendix contains a small list of literature sources. These provide some idea for your master thesis. The answer to the question "What is the Internet of Things?" give the figures in chapter 16 of my book "Technology of IP Networks" (in German) - see address:

https://www.researchgate.net/publication/331651693

The section 18.1.6 of this book also contains some sources of IoT security.

Much success and best regards

Anatol Badach

Hui Suoa, Jiafu Wana,Caifeng Zoua, Jianqi Liua: "Security in the Internet of Things: A Review" 2012 International Conference on Computer Science and Electronics Engineering https://www.researchgate.net/publication/254029342

Lara Vaghela: "Cross-layer design in the Internet of Things (IoT): Issues and possible solutions" https://www.researchgate.net/publication/311950826

Jorge Granjal, Edmundo Monteiro, Jorge Sá Silva: "Security for the Internet of Things: A Survey of Existing Protocols and Open Research Issues"; IEEE Communications, Surveys & Tutorials, DOI: 10.1109/COMST.2015.2388550

https://www.researchgate.net/publication/272641092

René Hummen, Jens Hiller, Hanno Wirtz, Martin Henze, Hossein Shafagh, Klaus Wehrle: 6LoWPAN Fragmentation Attacks and Mitigation Mechanisms; March 2012

https://www.researchgate.net/publication/259184554

Ismail Butun: A Survey of Intrusion Detection Systems in Wireless Sensor Networks; IEEE Communications Surveys & Tutorials, May 2013

https://www.researchgate.net/publication/254256844

Reza Ebrahimi Atani, Yashar Deldjoo: A SURVEY OF NODE CAPTURE ATTACKS IN WIRELESS SENSOR NETWORKS; Technical Report, January 2013

https://www.researchgate.net/publication/311328870

Shahriar Mohammadi, Reza Ebrahimi Atani, Hossein Jadidoleslamy: A Comparison of Link Layer Attacks on Wireless Sensor Networks, Journal of Information Security, 2011,doi:10.4236/jis.2011.22007

https://www.researchgate.net/publication/310510404

Md. Mahmud Hossain, Maziar Fotouhi, Ragib Hasan: "Towards an Analysis of Security Issues, Challenges,and Open Problems in the Internet of Things"

https://www.researchgate.net/publication/279801184

Sabrina Sicari, Alessandra Rizzardi, Luigi Alfredo Grieco, Alberto Coen-Porisini:"Security, privacy and trust in Internet of Things: The road ahead"; Computer Networks, January 2015

https://www.researchgate.net/publication/311366093

Tobias Heer, Oscar Garcia-Morchony, René Hummen,Sye Loong Keohy, Sandeep S. Kumary, Klaus Wehrle: Security Challenges in the IP-Based Internet of Things; Wireless Personal Communications, December 2011

https://www.researchgate.net/publication/225738726

Emmanouil Vasilomanolakis, Jörg Daubert, Manisha Luthra, Vangelis Gazis, Alex Wiesmaier, Panayotis Kikiras: "On the Security and Privacy of

Internet of Things Architectures and Systems", INTERNATIONAL WORKSHOP ON SECURE INTERNET OF THINGS (SIOT 2015), DOI: 10.1109/SIOT.2015.9

https://www.researchgate.net/publication/282075370

Kim Thuat Nguyen, Maryline Laurent, Nouha Oualha: Survey on secure communication protocols for the Internet of Things; February 2015 Ad Hoc Networks, February 2015;

DOI: 10.1016/j.adhoc.2015.01.006

https://www.researchgate.net/publication/272297653

Qi Jing, Athanasios V. Vasilakos, Jiafu Wan, Jingwei Lu, Dechao Qiu: "Security of the Internet of Things: perspectives and challenges"

Wireless Networks, November 2014; DOI 10.1007/s11276-014-0761-7

https://www.researchgate.net/publication/271681772

Thomas Kothmayr, Corinna Schmitt, Wen Hu, Michael Brünig, Georg Carle: "DTLS based Security and Two-Way Authentication for the Internet of Things", Ad Hoc Networks, November 2013

https://www.researchgate.net/publication/259104946

Sathish Alampalayam Kumar, Tyler Vealey, Harshit Srivastava: "Security in Internet of Things: Challenges, Solutions and Future Directions", 49th Hawaii International Conference on System Sciences, 2016

https://www.researchgate.net/publication/301281714

Muhammad Umar Farooq, Muhammad Waseem, Anjum Khairi, Sadia Mazhar: "A Critical Analysis on the Security Concerns of Internet of Things (IoT)"; International Journal of Computer Applications, February 2015

https://www.researchgate.net/publication/272488555

Mohamed Abomhara, Geir M. Køien: "Cyber Security and the Internet of Things: Vulnerabilities, Threats, Intruders and Attacks", DOI: 10.13052/jcsm2245-1439.414

https://www.researchgate.net/publication/277718176

Thankyou everyone

Dear ousama

Have a look to thus article it will be a good start:

Article A Survey of Internet of Things (IoT) Authentication Schemes

Dear Mr. Ousama

I think Mr. Mizrah has made an interesting observation of the difference between the new IOT vulnerabilities versus the traditional Internet of computers, information exchanges and data collection.

The goal of securing information at rest, in transit and when it is being processed is being complicated by the "things" and the vulnerability of the things that may be using AI and ML to produce "bad information" or at least information that cannot be trusted.

Facebook, for example recently exchanged millions of copies of a "slowed down" Speaker of the House of Representatives, via a doctored file. The timing adjustment conveyed the impression she was intoxicated and slurring her speech.

The photoshopping incident was easily identified. What happens if the camera that actually collected the event data had been programmed to produce the file. How do we maintain trust with the IOT devices that can be self programed with AI and ML to alter reality instead of collect it? A new digital vulnerability?

Firstly i would like to state that there are currently no specific legislation regarding iot devices all though certain areas would be covered under other legislation such as gdpr and should be manufactured and installed with IDO27001 framework in mind.

Consider why the vulnerabilities are there in the first place, ie manufacturers have no incentive to focus on security as it comes to a cost to them, thus increasing sale cost in competitive market. As with above they have no legal obligation to do so either. Also look at the causes of such vulnerabilities such as low power availability, low processing power.

Maybe consider looking into the OWASP top 10 IoT vulnerabilities and expand on 1.

I have recently written a paper on this and have lots of literature should you want it.

I suggest you look at the work of Frank Grietzer who developed an ontology for insider threat analysis called SOFIT https://www.sciencedirect.com/science/article/pii/S1877050919307495

and look at developing a similar ontology for IoT.

https://www.ieee-security.org/TC/SPW2018/WRIT/WRIT%202018%20SOFIT%20Sociotechnical%20and%20Organizational%20Factors%20for%20Insider%20Threat.pdf

https://www.sciencedirect.com/science/article/pii/S1877050919307495

Look at why the security is weak from a commercial POV.

something like.

The IoT space is relatively new and is moving and changing rapidly. The marketplace is crammed with literally thousands of products and the push to be ‘first to market’ is relentless. A products life at the top of the sales charts (or on the chart at all) is brief, as so many alternatives are surfacing every day.

A typical IoT manufacturer:

· Does not operate on huge returns to be able to invest in top-notch security for their products.

· Do not have a customer base on to which the cost of security can be passed, as their customers are not buying internet technology. They are buying the product into which it is embedded, and may never use the on-line functionality, so are not willing to pay a premium for it.

· Typically use inexpensive and simplistic hardware that does not lend itself to robust security.

IoT internet connectivity is typically enabled through cheap, single purpose, specialised computer chips, loaded with limited open source software.

· Generally are not computer or security companies, so do not see offering security as their role or responsibility

So the question is not so much why they don’t invest in security, as why would they? where there is no financial incentive, reputation to be lost, or wrath of regulators to contend with.

I would suggest you to go through the following two articles. You will get an insight about how to proceed your thesis:

1. http://scholar.google.co.in/scholar_url?url=https://www.researchgate.net/profile/George_Hadjichristofi/publication/304408245_Internet_of_Things_Security_vulnerabilities_and_challenges/links/598188270f7e9b7b524b92ac/Internet-of-Things-Security-vulnerabilities-and-challenges.pdf&hl=en&sa=X&scisig=AAGBfm3e6DZiIBHSBlXn4j4__WOl5evFtg&nossl=1&oi=scholarr

2. http://scholar.google.co.in/scholar_url?url=https://www.riverpublishers.com/journal_read_html_article.php%3Fj%3DJCSM/4/1/4&hl=en&sa=X&scisig=AAGBfm0K02CYoUpdls9ee3vYI2S0QyMb5A&nossl=1&oi=scholarr

Following