| dc.description.abstract | Internet of Things (IoT) is a progressively growing networking paradigm that connects various devices or things including sensors, software, electronics and other physical objects to collect and exchange data. Due to the emerging things concentration, heterogeneity, and dynamic changes in the IoT environment, achieving security efficacy in it has become a challenging task and critical concern. Conventional security controls, such as intrusion detection and prevention system (ID/PS), firewalls, and anti-virus programs, can only monitor a particular infrastructure unit and safeguard a particular service, such as access control, with a limited context visibility. For instance, a network firewall, based on predefined rules, can only analyze packets at the perimeter and cannot observe a user or process activity or behavior on an endpoint to assess a situation holistically. From a design viewpoint, it may not be practical to implement them in resource-constrained things, e.g. in body sensors. These controls are platform-specific and are not feasible to be realized in a multi-vendor heterogeneous space as the IoT. Moreover, the literature concerning information security risk management (ISRM) models mostly focuses on a particular security service, e.g. confidentiality or authentication. The different phases in them are executed on an on-demand basis. Besides security, they do not consider any runtime objectives and lack efficient response strategies. The controls and ISRM models that support response mechanisms either utilize fixed or static approaches, i.e. they either implement predefined mitigation rules which might not address the dynamic threat landscape, or they tend to mitigate a risk manually and therefore, increase response latency. Furthermore, their mitigation strategies only focus on asset protection and do not assess other runtime factors, such as user and QoS preferences, that may be affected by a mitigation response. Hence, they may not be practical choices in IoT-driven systems particularly in a usercentric system, such as the IoT-enabled remote patient monitoring systems, which necessitates continuous and real-time services. Adaptive security can be an effective tool to address threats in the IoT as it can observe, analyze and react to them dynamically on the fly. However, there is no clear evidence to establish how such a solution can be developed for this heterogeneous and lightweight objects driven network, and to what extent will it be feasible to take dynamic trade-off decisions. These problems led this research to investigate the feasibility of a poteni tial adaptive security solution for the IoT. This thesis contributes an Eventdriven Adaptive Security (EDAS) model that satisfies the adaptive risk management requirements in IoT-driven smart spaces. It can observe, analyze and react to security changes (things-generated events) at the infrastructural level and offers a context-aware security adaptation approach. It utilizes a novel runtime adaptation ontology that enables the system to take a dynamic trade-off decision. Therefore, besides security, it evaluates other critical runtime objectives, such as the available resources, user preferences and QoS requirements to ensure optimized adaptation. This thesis also contributes to the implementation and pre-development essentials of EDAS. A prototype has been developed that details the implementation blueprint of EDAS. The prototype demonstrates EDAS as a reusable, extendable, and flexible model, and evaluates it as a real-world artifact. A scenario-based evaluation method has been suggested that provides a pre-development tool to assess and realize the knowledge necessary for optimized adaptation. By using the evaluation method, this thesis provides clear evidence that EDAS can effectively address all the potential runtime factors or trade-offs in a particular adaptation decision. Major limitations concerning, architectural constraints, scalability issues, and the use of security metrics have been identified, which are necessary for EDAS to be a robust and reliable solution for IoT security. Preliminary insights to approach these concerns in the future are also discussed. | eng |
