(A) first approach to monitoring the security status of IoT devices at the state level

Abstract

As Internet of Things (IoT) devices have become more attractive as attack targets, cyber threat intelligence often requires accurate information about these smart gadgets within a nation state. Yet, collecting the security status (e.g., whether the latest security patch has been installed) of all IoT devices at the state level is difficult due to a lack of technical capability and economic incentives. In this paper, we argue for a technical and regulatory approach to this problem and present the vision of IoTell, which enables state governments to monitor the security status of deployed IoT devices. We envision that our proposal will aid the public agency in comprehending the current security status of the IoT ecosystem. With our IoTell protocol, a security agency receives accurate, periodically-updated (e.g., every day) counts of all IoT firmware versions operating in a nation. IoTell requires only widely available market-ready technical capabilities and minimal modifications to IoT devices and network operators. We present an end-to-end protocol architecture for IoTell that addresses potential privacy and security issues.