Practical Internet of Things Security - Second Edition

Post-incident device forensics

As part of an investigation process, system-level investigation may lead you to one or more devices (for example, sensor, actuator, gateway, or other server), and therefore a thorough forensic examination of the compromised device is in order to try to determine the characteristics of the attacker.

You may find specific files loaded or modified by the attacker, or in some cases it may be possible to lift fingerprints from the device itself. Device analysis of device gateways may involve components located at the network edge, or centrally within a CSP (for example, a virtualized system).

Typically, a response team would capture images of the compromised systems for offline evaluation. This is where infrastructure ...