Cybercrime is a serious threat to any organization, with average data breach costs reaching over USD 4 million (Mack, 2021). Companies today face many potential cyber risks each year, and the results can be catastrophic.
Since Internet of Things (IoT) devices often face attacks as soon as 5 minutes after connecting, they can present a severe vulnerability (Jovanović, 2022). The number of devices connected to the internet has skyrocketed and now includes many medical devices, smart home components, and even e-cigarettes.
With the increase in IoT devices, IoT-related cyberattacks have also grown, giving rise to IoT forensics. What does digital forensics mean in the IoT context, and what is its purpose?
What Is IoT Forensics?
IoT forensics is the practice of analyzing IoT devices to investigate crimes. Organizations or law enforcement may hire experts to gather and preserve data when investigating whether hackers used internet-connected devices to commit cybercrimes or examine the source of a security breach.
In some instances, breaches occur due to malicious intent. In other cases, they may result from human error—for example, if an employee shares sensitive information due to a phishing attack. The employee may have had no intention to steal data or harm the company, yet the results of sharing that data accidentally can be just as catastrophic. These phishing attacks cause nearly nine out of 10 data breaches (Cisco Umbrella, 2021).
Cyber forensics can help determine the exact intent and extent of a breach. Typical IoT-related cyberthreats may include:
- Malware, including ransomware
- Botnets and Distributed Denial-of-Service (DDoS) attacks
- Data theft
IoT forensics does not just involve the investigation of cybercrimes. Even on-site crimes like burglaries may produce data on various devices to assist an investigation. However, the investigation process will vary depending on whether the device is smart, bringing us to the difference between IoT and digital forensics.
IoT Forensics vs. Digital Forensics
In short, digital forensics is any forensic investigation dealing with digital evidence, while IoT forensics is a more specialized branch of digital forensics focused on devices connected to the internet.
Connection to the internet provides unfortunate opportunities for data corruption or misplacement, but it also ensures that most data is readily available for legal review by an expert. IoT forensics experts use various methods to find digital evidence.
Extracting Data from IoT Devices
IoT forensics relies on sensors in various devices, such as smart kitchen appliances or wearables like fitness trackers. These sensors collect data that the device transfers to the cloud, where it can be stored, analyzed, or made available to intended recipients (Joseph, 2021). This is where cloud forensics and IoT forensics intersect: the retrieval of data transferred from IoT devices to the cloud.
Since data travels through various networks and multiple sources, there can be considerable differences in the methods used for locating crucial digital evidence. Any computer forensics investigation must include provisions for multiple standards and data formats.
Challenges in IoT Forensics
Some data is heavily encrypted, and in some cases, decryption may be highly problematic—for example, if the decryption token has been lost or corrupted or if the encryption method is unusual or error-prone. Often, data suffers from corruption during transfer or as vendors store it over extended periods.
Thankfully, many companies have policies for preserving data throughout a specific period. However, providers also typically protect data from access except when someone can prove a legal right to access the data. This means that data forensics may require legal action and many special permissions that can be difficult to obtain, depending on the individual policy of the storage provider.
In summary, the challenges facing cyber forensics investigations of IoT devices include:
- Lack of data standardization across vendors
- Difficulty in decryption
- Data corruption
- Restrictions related to data protection and privacy laws
Locating Data Traces
Maintaining data quality in evidence is essential for IoT forensics (Gómez et al., 2021). Extracting data involves working around the challenges of following a digital “footprint” through the various data collection and storage stages. This can be complex depending on the quality of the data.
IoT forensics experts have developed various automated methods to simplify the investigation process and make it more effective, resulting in clean, parsed, and structured data that can be used for investigative purposes.
1. Data Traces on Devices
This usually begins with uncovering information within the device itself, such as a smartphone. Unfortunately, many devices only store data for a short time. While most data leaves “traces” behind, these could be fragile and easily corrupted.
2. Data Traces in Networks
Networks used to transfer data may also maintain traces for a specific time. Again, these data traces are fragile and may disappear quickly. Moreover, different networks and processes will use varied encryption methods, creating additional hurdles.
3. Data Traces in the Cloud
Any data transferred from IoT devices stored in or moved within the cloud will leave digital traces behind. Cloud service vendors and ethical hackers can often aid cyber forensics by preserving and recovering such relics. Of course, they do so only when the recipient has the legal authority to make such a request.
Getting Trained for IoT Forensics
The digital forensics market is expected to double within 5 years (Markets and Markets, 2018). Considering the rapidly rising number of IoT devices and associated cyber risks, the field of IoT forensics is likely to expand.
References
Cisco Umbrella. (2021). Cybersecurity threat trends. https://umbrella.cisco.com/info/2021-cyber-security-threat-trends-phishing-crypto-top-the-list
Gómez, J. M. C., Mondéjar, J. C., Gómez, J. R., & Martínez, J. M. (2021). Developing an IoT forensic methodology. A concept proposal. Forensic Science International: Digital Investigation, 36(Supplement), 301114. https://www.sciencedirect.com/science/article/pii/S2666281721000081 – ! https://www.sciencedirect.com/science/article/pii/S2666281721000081
Joseph, M. A. (2021). Digital forensics is ready for its most recent challenge: IoT forensics. LinkedIn. https://www.linkedin.com/pulse/digital-forensics-ready-its-most-recent-challenge-iot-joseph/
Jovanovic, B. (2022, March 8). Internet of Things statistics for 2022 – Taking things apart. DataProt. https://dataprot.net/statistics/iot-statistics/
Mack, G. (2021, December 2). Alarming cyber security facts to know for 2021 and beyond. CyberTalk.org. https://www.cybertalk.org/2021/12/02/alarming-cyber-security-facts-to-know-for-2021-and-beyond/
Markets and Markets. (2018). Digital forensics market. https://www.marketsandmarkets.com/Market-Reports/digital-forensics-market-230663168.html
About the Author
Sarah Huard has experience writing for a variety of industries, including but not limited to health and medicine, fitness, software and technology.
More Articles Like This
