CAF-IoT: A Cybersecurity Assessment Framework for IoT Devices

Abstract

The Internet of Things (IoT) has become essential across various domains, including healthcare, industrial automation, critical infrastructure, and smart cities. However, its rapid evolution has introduced significant cybersecurity challenges, especially in hardware security and communication protocols. Successful cyberattacks can lead to catastrophic consequences, from data breaches to disruptions in critical infrastructure, highlighting the need for advanced cybersecurity measures and thorough cybersecurity assessments to guarantee the proper employment of these measures. Despite the growing concern, the literature still lacks comprehensive frameworks for evaluating the hardware security of IoT devices, with most studies primarily focusing on software vulnerabilities and other layers in the IoT system. This paper proposes a novel framework for assessing cybersecurity of IoT devices (CAF-IoT), tailored for hardware security including hardware components, communication protocols and buses within the perception layer. The framework automates vulnerability assessments, identifies security risks, and recommends mitigation strategies. The framework is validated through real-time penetration testing experimentation against several IoT devices, demonstrating its effectiveness in exploring various attack surfaces and detecting and analyzing existing vulnerabilities for enhanced security evaluation.