AQLLI UY QURILMALARIDA KIBERXAVFSIZLIK MUAMMOLARI: ARXITEKTURA, ZAIFLIKLAR VA ULARNI BARTARAF ETISH YO‘LLARI
Keywords:
aqlli uy, IoT, kiberxavfsizlik, CIA triadasi, autentifikatsiya, shifrlash, OWASP, dasturiy zaifliklar, mahsulot javobgarligi, kiberxavfsizlik iqtisodiyoti.Abstract
Ushbu ishda aqlli uy (Smart Home) qurilmalarining texnik arxitekturasi va ular bilan bog‘liq kiberxavfsizlik muammolari kompleks tarzda tahlil qilinadi. Dastlab aqlli uy tizimining uch qatlamli modeli — qurilma qatlami, tarmoq/ma’lumot uzatish qatlami va ilova qatlami — hamda ushbu ekotizimdagi to‘rt guruh ishtirokchi (foydalanuvchi, ishlab chiqaruvchi, tarmoq provayderi, ilova xizmati provayderi) ko‘rib chiqiladi. Aqlli termostat, aqlli qulf va aqlli bolalar monitori misolida funksionallik ortishi bilan xavfsizlik xavfining o‘sishi o‘rtasidagi bog‘liqlik ochib beriladi. Kiberxavfsizlikning nazariy asosi sifatida CIA (Confidentiality, Integrity, Availability) triadasi va "zaiflik → tahdid → insident → zarar" jarayoni tavsiflanadi. OWASP tashkilotining IoT qurilmalaridagi eng muhim kamchiliklar ro‘yxatiga tayanib, dasturiy/firmware zaifliklari, autentifikatsiya va avtorizatsiyaning yetarli emasligi hamda ma’lumot uzatishda shifrlashning yo‘qligi statistik ma’lumotlar (xususan, Hewlett Packard Enterprise, 2015) va real hodisalar (Mirai botneti, aqlli qulf va bolalar monitorlarining buzib kirilishi) misolida batafsil yoritiladi. Shuningdek, yetkazilgan zararni qoplash (kompensatsion) va uning oldini olish (preventiv) choralari nuqtai nazaridan huquqiy yondashuvlar tahlil qilinadi. Tadqiqot natijalariga ko‘ra, aqlli uy qurilmalarida kiberxavfsizlikning yetishmasligi texnik (resurs cheklovlari), iqtisodiy (bozor rag‘batining yo‘qligi) va inson omili (foydalanuvchi va ishlab chiqaruvchi bilimining yetarli emasligi) kabi uch darajali muammolar majmuidan kelib chiqadi va uni faqat kompleks — texnik, tashkiliy hamda huquqiy choralar uyg‘unligi orqaligina bartaraf etish mumkin.
References
1. Van den Heuvel K. Securing the Smart Home: A study on cybersecurity problems in smart home devices and European product liability law: Information Law Research Master Thesis. – Amsterdam: University of Amsterdam, 2018. – 129 b.
2. Bugeja J. va boshq. On Privacy and Security in Smart Connected Homes // 2016 European Intelligence and Security Informatics Conference (EISIC), Uppsala. – 2016. – B. 1–14.
3. OECD Working Party on Communication Infrastructures and Services Policy. The Internet of Things: Seizing the Benefits and Addressing the Challenges. – Paris: OECD Publishing, 2015. – B. 9.
4. Poudel S. Internet of Things: Underlying Technologies, Interoperability and Threats to Privacy and Security // Berkeley Technology Law Journal. – 2016. – T. 31. – B. 997–1022.
5. Nissenbaum H. Where Computer Security Meets National Security // Ethics and Information Technology. – 2005. – T. 7. – B. 61–73.
6. Arnbak A. Securing Private Communications: doktorlik dissertatsiyasi. – Amsterdam: University of Amsterdam, 2015. – B. 155–171.
7. Samaila M.G. va boshq. Security Challenges of the Internet of Things // Beyond the Internet of Things: Everything Interconnected. – Cham: Springer International Publishing AG, 2017. – B. 54–71.
8. OWASP. Top IoT Vulnerabilities [Elektron resurs]. – URL: https://www.owasp.org (murojaat sanasi: ...).
9. Hewlett Packard Enterprise. Internet of Things Research Study: texnik hisobot. – Palo Alto: HPE, 2015. – B. 5.
10. BITAG. Internet of Things (IoT) Security and Privacy Recommendations: texnik hisobot. – Denver: Broadband Internet Technical Advisory Group, 2016. – B. 1–20.
11. ENISA. Baseline Security Recommendations for IoT in the context of Critical Information Infrastructures: texnik hisobot. – Heraklion: European Union Agency for Network and Information Security, 2017. – B. 18–32.
12. Ragan S. Here are the 61 passwords that powered the Mirai IoT botnet // CSO Online. – 2016.
13. Symantec. Internet Security Threat Report. – Mountain View: Symantec Corporation, 2017. – B. 66.
14. Dean B.C. An Exploration of Strict Products Liability and the Internet of Things: texnik hisobot. – Washington, D.C.: Center for Democracy & Technology, 2018. – B. 1–9.
15. Yevropa Ittifoqi. 85/374/EEC-son Kengash Direktivasi — nuqsonli mahsulotlar uchun javobgarlikka oid a'zo davlatlarning qonun, qoida va ma'muriy qoidalarini yaqinlashtirish to'g'risida (Mahsulot uchun javobgarlik direktivasi). – 1985.
