## 4 Devices' Vulnerabilities and Requirements
### IoT Vulnerabilities  
IoT devices are creating great experiences for consumers, and are everywhere around us. With the growth of IoT devices, security threats are also increasing as hackers are getting a chance to manipulate a huge amount of data in the vastly connected world. Without proper security in place, IoT devices will be vulnerable to sensitive data leakage. IoT and cybercriminal activity are invisible to the naked eye, and they can reach us anytime. Furthermore, IoT devices are vulnerable to assaults and security risks since they lack the essential built-in security to fight threats due to their low price, minimal power, and poor computing capability, as well as the network's heterogeneity and scale. IoT devices are vulnerable to threats not only for technical aspects but also to users' activity. Here are a few of the reasons why these smart devices are still at risk [60]:  
* Limited computing capabilities and hardware limitations: These devices are designed for particular applications that require only limited processing capabilities, leaving minimal area for security and data protection to be integrated.
* Heterogeneous transmission technology: These devices communicate with different kinds of devices and frequently use various communication technologies, which make it difficult to establish uniform protection measures and protocols.
* Components of the device are vulnerable: Millions of smart devices can be harmed by insecure or outdated fundamental elements.
* Users lacking security awareness: Due to a lack of user security knowledge, smart devices may be exposed to risk zones and attack possibilities. Many IoT devices allow users to integrate third-party apps, which could also drive the device into a danger zone.
* Weak Physical Security: Unlike data centers of internet services, not only just users, but also others with heinous intents, have physical access to a major share of IoT components.  
In [61], the security issues are divided into Software level threats, and Hardware level threats, as shown in Figure 8. Hacking, information leakage, illegal access, and more. are defined as software level attacks to force the system to malfunction and collect desired information like credit card information, password, etc. A firewall, updated virus database, and up-to-date software usage can limit software-based attacks. Not only software-level attacks but also hardware-level attacks are prominent scope for attackers. To build complete secure hardware, secure Integrated Circuits (IC) or SoCs are required to develop. It is becoming complex due to nano-scale design, distribution of embedded Very Large Scale Integration (VLSI) chip fabrication, and also the incorporation of third-party Intellectual Property (IP) core. Insertion of a single malicious circuit during the fabrication process can make the system compromised, and this can be invisible to designers.  
In Figure 9, the pyramid of threat factors is represented based on vulnerabilities and impacts [23; 62]. The top elements of the pyramid are more vulnerable with minimum probable impact and lower-level elements show opposite characteristics. It can be asserted that Cyber threats seek greater control and opportunities further down the stack.  
There are defects in a system's component that render it vulnerable and expand the attack surface. In particular, an adversary tends to exploit the hardware or software of the IoT system to gain access to perform their malicious activity. In the report of HP, they found that 50% of the commercially available IoT has a significant security flaw [58]. It is essential to prevent and react against previously listed vulnerabilities as they could expose sensitive information and exploit the IoT system. Since IoT network is exposed to different kinds of attacks, it is a complex task for the security analysis and imposes full-proof security measures. Nevertheless, the massive volume of data generated by IoT environments is leveraging the enhancement of the security level of the entire system.