Learning from others’ mistakes: penetration testing IoT devices in the classroom

Research output: Contribution to conference (unpublished)Paperpeer-review

Colleges, School and Institutes

Abstract

This paper shows how it is possible to use commercial off-the-shelf IoT devices in a taught cyber security course. We argue that the current level of IoT device security makes testing them an excellent exercise for students. We have developed a course based around this idea that teaches students basic penetration testing techniques and then sets two rounds of group assignments in which they get hands-on experience with performing a security analysis of an IoT device. In the first round, the students get devices which we know are vulnerable. In the second round, the groups are mixed and they get devices with no previously known vulnerabilities. This approach enables us to provide them enough guidance in the first round to get the experience needed to perform the analysis independently in the second round. This seems to have been successful because our student teams found previously unknown vulnerabilities in five devices in the second round of tests.

Details

Original languageEnglish
Publication statusPublished - 9 Aug 2016
EventUSENIX Workshop on Advances in Security Education -
Duration: 9 Aug 201610 Sep 2016
https://www.usenix.org/conference/ase16

Conference

ConferenceUSENIX Workshop on Advances in Security Education
Period9/08/1610/09/16
Internet address

Keywords

  • cyber security , education