Practical Internet of Things Security - Second Edition

Step 5 – document the threats

This step focuses on documenting the threats to the parking system:

Threat description #1	Parking thief charges legitimate customer for parking time by accessing that customer's account.
Threat target	Legitimate customer account credentials
Attack techniques	Social engineering, phishing, database compromises, MITM attacks (including those against cryptographic protocols)
Countermeasures	Require multifactor authentication on accounts used to access payment information
Threat description #2	Parking thief receives free parking through unauthorized access to backend smart parking application.
Threat target	Parking application
Attack techniques	Application exploit; web server ...