Categorizing IoT Software Systems Security Vulnerabilities Through Literature Studies

Despite the popularity of IoT software systems and the enormous variety of intelligent devices, there are still security challenges, considering the lack of descriptions of practices that can support the mitigation of security risks, augmenting the uncertainties on the weaknesses encompassing such systems. Therefore, this paper presents the results of two literature studies (ad-hoc and structured) that can contribute to the decision-making regarding mitigating risks associated with security vulnerabilities in IoT software systems. The ad-hoc literature study identified 27 coarse-grained security vulnerabilities from software organizations. The structured literature study identified 69 fine-grained security vulnerabilities from the technical literature, which allowed identifying and categorizing these vulnerabilities into four categories (application, network, device, and Peopleware) for better organization and understanding. The results comparison highlighted a set of 30 most impactful security vulnerabilities that should be considered by software engineers when mitigating the risks regarding the lack of security in IoT software systems.