IoT-Armor: An IoT Secure-by-Default Educational Toolkit

物联网设备在我们的环境中无处不在，成为我们日常生活中不可或缺的一部分。这些设备的绝对数量已经从2021年的38亿激增到2025年的估计309亿。这种激增带来了漏洞的显著增加，估计到2023年底，每年的损失将达到惊人的1160亿美元。这些漏洞在很大程度上可归因于物联网设备的简化架构以及设备制造商和应用程序开发人员对安全原则的有限掌握。物联网安全基金会指出，这些问题的根本原因是缺乏合理的安全设计原则。这些发现与英国政府的消费者物联网安全实践准则密切相关，该准则强调了在制造此类设备时纳入默认安全原则的必要性。然而，尽管这个问题已经被明确识别出来，但在有效实施这些默认安全原则方面仍然存在明显的知识差距。进入物联网装甲，旨在填补这一空白。我们开创了一种创新的解决方案，通过提供全面的培训材料，使个人不仅能够理解而且能够熟练地应用默认安全原则，从而弥合这一市场差距。使我们的方法与众不同的是我们利用现成的硬件，并辅以我们的定制固件。这确保了我们的培训资源是普遍适用的，并且不依赖于特定的硬件。此外，我们将培训内容与《消费者物联网安全实践准则》进行了细致的调整，确保我们的客户始终遵守潜在的政府指导方针、法规或标准化。从本质上讲，这意味着我们的客户可以自信地应对不断变化的安全要求，因为他们已经做好了充分的准备。

IoT devices have become ubiquitous in our environment, becoming an integral part of our daily routines. The sheer quantity of these devices has surged, from 3.8 billion in 2021 to an estimated 30.9 billion by 2025\. This proliferation has brought with it a significant rise in vulnerabilities, with estimated annual losses reaching a staggering $116 billion by the close of 2023\.These vulnerabilities can be largely attributed to the simplified architecture of IoT devices and the limited grasp of security principles by both device manufacturers and application developers. The IoT Security Foundation has pinpointed the root cause of these issues as the absence of sound security design principles. These findings closely align with the UK Government's Code of Practice for Consumer IoT Security, which underscores the imperative of incorporating Security-by-Default principles during the manufacturing of such devices. Yet, despite the clear identification of this problem, there remains a conspicuous knowledge gap in effectively implementing these Security-by-Default principles.Enter IoT-Armor, aimed at filling this void. We have pioneered an innovative solution that bridges this market gap by providing comprehensive training materials, equipping individuals to not only comprehend but also adeptly apply Security-by-Default principles. What sets our approach apart is our utilisation of readily available hardware, complemented by our custom firmware. This ensures that our training resources are universally applicable and free from dependence on specific hardware. Moreover, our meticulous alignment of training content with the Code of Practice for Consumer IoT Security guarantees that our clients remain in compliance with potential government guidelines, regulations, or standardisation. In essence, this means our customers can confidently navigate evolving security requirements knowing that they are well-prepared.