<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-iot-threat-modeling
description: >-
  Threat model IoT devices across hardware, firmware, communication, and cloud layers.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - iot-security
  - embedded
  - firmware
  - mqtt
  - ble
  - device-lifecycle
  - physical-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - "T0800"
  - "T0836"
  - "T0855"
  - "T0862"
---

# Performing IoT Threat Modeling

## Overview

IoT devices present unique threat vectors: constrained resources limit crypto capabilities,
physical access enables hardware attacks, firmware updates may lack signing, and communication
protocols like MQTT/CoAP/BLE have distinct security models. This technique adapts threat
modeling for the full IoT device lifecycle.

Mode: `[MODE: ARCHITECT]` — IoT and embedded systems security architecture.

## Prerequisites

- Device architecture documentation (hardware, firmware, communication)
- Protocol specifications (MQTT, CoAP, BLE, Zigbee)
- `binwalk` for firmware analysis: `apt install binwalk`
- Python 3.10+

## Key Concepts

### IoT Attack Surface Layers

| Layer | Components | Threat Examples |
|-------|-----------|----------------|
| **Hardware** | Debug ports, JTAG, UART, sensors | Physical tampering, side-channel attacks |
| **Firmware** | OS, bootloader, application code | Unsigned updates, hardcoded credentials |
| **Communication** | MQTT, BLE, WiFi, Zigbee, cellular | Eavesdropping, replay, injection |
| **Cloud Backend** | API, device management, OTA updates | Account takeover, insecure provisioning |
| **Mobile App** | Companion app, local pairing | Insecure storage, cleartext communication |

### Device Lifecycle Threats

| Phase | Threats | Controls |
|-------|---------|----------|
| Manufacturing | Supply chain tampering, key leakage | Secure provisioning, HSM |
| Deployment | Insecure default config, weak pairing | Secure onboarding, unique credentials |
| Operation | Firmware attacks, network pivoting | Signed OTA, network segmentation |
| Maintenance | Unauthorized updates, debugging exposure | Secure update channel, disable debug |
| Decommission | Data remnants, credential persistence | Secure wipe, certificate revocation |

## Workflow

### Step 1: Enumerate IoT Components

```bash
node scripts/agent.js --action enumerate --input device_spec.json
binwalk -e firmware.bin
```

### Step 2: Map Threats by Layer

```bash
node scripts/agent.js --action threats --input components.json
```

### Step 3: Generate Report

```bash
node scripts/agent.js --action report --input threats.json --output report.json
```

## Verification

- [ ] All device interfaces inventoried (physical, wireless, cloud)
- [ ] Communication protocols analyzed for encryption and authentication
- [ ] Firmware update mechanism validated (signing, transport security)
- [ ] Physical attack vectors assessed (debug ports, JTAG, tampering)
- [ ] Device lifecycle security reviewed from provisioning to decommission
- [ ] Compliance checked against NIST IR 8259 and ETSI EN 303 645

## References

- [OWASP IoT Top 10](https://owasp.org/www-project-internet-of-things-top-10/)
- [NIST IR 8259 — IoT Device Cybersecurity](https://csrc.nist.gov/publications/detail/nistir/8259/final)
- [ETSI EN 303 645 — Consumer IoT Security](https://www.etsi.org/deliver/etsi_en/303600_303699/303645/)
- [MITRE ATT&CK for ICS](https://attack.mitre.org/techniques/ics/)
