Security monitoring system for internet of things (IOT) device environments
Techniques are described for implementing a security service that can be used to monitor and provide security-related information for Internet of Things (IoT) devices. An IoT security service uses a reference framework to model the progressive stages of IoT security attacks, also referred to herein as an IoT kill chain. Each stage of an IoT kill chain is associated with a set of security threat “facilitators” and/or security threat “indicators.” Facilitators represent characteristics of an IoT device that cause the device to be susceptible to various types of security threats, while indicators represent detected device activity indicating a potential ongoing security attack. An IoT security service collects data from IoT devices being monitored and possibly other related components, analyzes the collected data to detect defined facilitators and indicators, and uses the detected facilitators and indicators to calculate various security scores for individual devices or for groups of devices.
1. A computer-implemented method comprising:
obtaining, by an Internet of Things (IoT) security service, device profile data and device activity data for a computing device in a computer network comprising a plurality of computing devices, the device profile data identifying characteristics of the computing device and the device activity data identifying actions related to the computing device, and wherein the computing device is an IoT device;
identifying, based on the device profile data, one or more security threat facilitators, each of the one or more security threat facilitators representing a potential security threat vector associated with the computing device;
identifying, based on the device activity data, one or more security threat indicators, each of the one or more security threat indicators representing evidence of a potential security attack;
calculating, based on the one or more security threat facilitators and the one or more security threat indicators, a breach likelihood score indicating a likelihood that the computing device has been compromised; and
providing access to security data indicating the breach likelihood score, the one or more security threat facilitators, and the one or more security threat indicators.
2. The computer-implemented method of claim 1 , further comprising:
calculating, based on the one or more security threat facilitators, a threat level score indicating a likelihood that the computing device is compromised in the future; and
wherein the security data further indicates the threat level score.
3. The computer-implemented method of claim 1 , wherein the breach likelihood score is calculated further based on device activity data obtained from a plurality of other IoT devices related to the IoT device.
4. A computer-implemented method comprising:
obtaining, by an Internet of Things (IoT) security service, data related to a computing device in a computer network comprising a plurality of computing devices, wherein the computing device is an IoT device;
identifying, based on the data, one or more security threat facilitators, each of the one or more security threat facilitators representing a potential security threat vector associated with the computing device, and one or more security threat indicators, each of the one or more security threat indicators representing evidence of a potential security attack;
calculating, based on the one or more security threat facilitators and the one or more security threat indicators, a breach likelihood score indicating a likelihood that the computing device has been compromised; and
providing access to security data indicating the breach likelihood score, the one or more security threat facilitators, and the one or more security threat indicators.
5. The computer-implemented method of claim 4 , wherein the breach likelihood score is calculated further based on data obtained from a plurality of other IoT devices related to the IoT device.
6. The computer-implemented method of claim 4 , further comprising:
calculating, based on the one or more security threat facilitators, a threat level score indicating a likelihood that the computing device is compromised in the future; and
wherein the security data further indicates the threat level score.
7. The computer-implemented method of claim 4 , wherein the data related to the computing device is obtained using one or more of: an on-device agent running on the computing device, a network monitor, and an IoT management service of a service provider network.
8. The computer-implemented method of claim 4 , wherein calculation of the breach likelihood score is further based on a severity value assigned to at least one of the one or more security threat facilitators and one or more security threat indicators.
9. The computer-implemented method of claim 4 , wherein calculation of the breach likelihood score is further based on data indicating ongoing security attacks involving at least one of the one or more security threat facilitators.
10. The computer-implemented method of claim 4 , wherein calculation of the breach likelihood score is further based on historical activity data related to the computing device.
11. The computer-implemented method of claim 4 , further comprising:
receiving input requesting additional information related to the breach likelihood score; and
causing display of information indicating the one or more security threat facilitators and one or more security threat indicators used to calculate the breach likelihood score.
12. The computer-implemented method of claim 4 , wherein the data includes device profile data including one or more of an indication of a device type, software running on the computing device, software versions running on the computing device, device network configurations, device encryption configurations, and wherein the data further includes device activity data including one or more of network traffic data, application data, file modification data, and device error activity.
13. The computer-implemented method of claim 4 , wherein providing access to the security data includes causing display of a graphical user interface (GUI) including a representation of one or more of: the breach likelihood score, the one or more security threat facilitators, and the one or more security threat indicators.
14. The computer-implemented method of claim 4 , further comprising generating, based on the breach likelihood score, a command causing one or more actions to occur relative to the computing device, the one or more actions including one or more of: rebooting the computing device, sending a software update to the computing device, modifying one or more network or system configurations associated with the computing device, collecting additional data from the computing device.
15. A system comprising:
a first one or more electronic devices to implement an Internet of Things (IoT) management service, the IoT management service including instructions that upon execution cause the IoT management service to:
collect device profile data and device activity data for a computing device in a computer network comprising a plurality of computing devices; and
send the device profile data and device activity data to an IoT security service; and
a second one or more electronic devices to implement the IoT security service, the IoT security service including instructions that upon execution cause the IoT security service to:
obtain the device profile data and device activity data;
identify, based on the device profile data and device activity data, one or more security threat facilitators, each of the one or more security threat facilitators representing a potential security threat vector associated with the computing device, and one or more security threat indicators, each of the one or more security threat indicators representing evidence of a potential security attack; and
calculate, based on the one or more security threat facilitators and the one or more security threat indicators, a breach likelihood score indicating a likelihood that the computing device has been compromised; and
provide access to security data indicating the breach likelihood score, the one or more security threat facilitators, and the one or more security threat indicators.
16. The system of claim 15 , wherein the computing device is an IoT device, and wherein the breach likelihood score is calculated further based on device activity data obtained from a plurality of other IoT devices related to the IoT device.
17. The system of claim 15 , wherein the IoT security service further includes instructions that upon execution cause the IoT security service to:
calculate, based on the one or more security threat facilitators, a threat level score indicating a likelihood that the computing device is compromised in the future; and
wherein the security data further indicates the threat level score.
18. The system of claim 15 , wherein providing access to the security data includes causing display of a graphical user interface (GUI) including a representation of one or more of: the breach likelihood score, the one or more security threat facilitators, and the one or more security threat indicators.
19. The system of claim 15 , wherein the IoT security service further includes instructions that upon execution cause the IoT security service to:
receive input requesting additional information related to calculation of the breach likelihood score; and
cause display of information indicating the one or more security threat facilitators and one or more security threat indicators used to calculate the breach likelihood score.
20. The system of claim 15 , wherein the IoT security service further includes instructions that upon execution cause the IoT security service to generate, based on the breach likelihood score, a command causing one or more actions to occur relative to the computing device, the one or more actions including one or more of: rebooting the computing device, sending a software update to the computing device, modifying one or more network or system configurations associated with the computing device, collecting additional data from the computing device.