I85PREP
⌘ K
CIoTSP study materials
CIoTSP study resources

CIoTSP: IoT Threat Modeling, Risk, and Vulnerability Management

CIoTSP · Work through your exam, one topic at a time.

All guide sections

IoT Threat Modeling, Risk, and Vulnerability Management

Domain 7 asks you to reason systematically about what can go wrong in an IoT system and to prioritise fixes when patching is slow or impossible.

Frameworks to name and apply

  • STRIDE per element and per trust boundary: Spoofing (device identity), Tampering (firmware, telemetry), Repudiation (weak logging), Information disclosure (plaintext MQTT), Denial of service (battery or bandwidth exhaustion), Elevation of privilege (gateway into cloud).
  • Attack trees for a concrete goal, such as unlock the door or falsify the tank level.
  • MITRE ATT&CK for ICS for adversary techniques against OT.
  • PASTA or OCTAVE where business impact must drive the model.

Procedure: enumerate assets, draw data flows, mark trust boundaries (device to gateway, gateway to cloud, cloud to user), apply STRIDE at each boundary, and record mitigations with residual risk and an owner.

Vulnerability management under constraints

  • Inventory first: you cannot patch unknown devices. Use passive fingerprinting; agents do not run on RTOS or class 0 hardware.
  • SBOM in SPDX or CycloneDX from suppliers, so embedded library CVEs become visible.
  • Prioritise with context: CVSS plus EPSS exploit probability, CISA KEV listing, internet exposure and blast radius. A base score alone misranks OT issues where a modest integrity bug can stop a production line.
  • Compensating controls where patching is impossible: segmentation, virtual patching at an IPS, egress allow-listing, and monitoring.

Worked example

A smart-lock vendor reports a CVSS 7.5 buffer overflow in the BLE stack. Reasoning: the base score ignores that exploitation needs radio proximity and prior pairing, but also that the impact is physical access. Exploitability is low (proximity, no public exploit, not in KEV) and impact is high (unlock). Decision: patch in the next maintenance window while applying compensating controls - disable pairing when unpaired, monitor anomalous pairing attempts, and notify high-risk sites - rather than recalling the fleet.

Traps that cost marks

  • Using the CVSS base score as the priority ranking.
  • Actively scanning fragile OT networks and causing the outage you were assessing.
  • Ignoring third-party components and supplier SBOM gaps.
  • A risk register with no owner, no review date and no residual-risk column.