IoT SECURITY ASSESSMENT & THREAT LANDSCAPE REPORT

Analysis of Vulnerabilities, Attack Surfaces, and Defense Architecture

• Author: Abdul Wahab (Cyber Security Student)
• Date: August 2026
• Classification: ACADEMIC RESEARCH
• Subject: IoT Devices
• Teacher: Farakh Fareed

Executive Summary

Cloud security is a discipline of cyber security dedicated to securing cloud computing systems. This includes keeping data private and safe across online-based infrastructure, applications, and platforms. Securing these systems involves the efforts of cloud providers and the clients that use them, whether an individual, small to medium business, or enterprise uses.

Cloud providers host services on their servers through always-on internet connections. Since their business relies on customer trust, cloud security methods are used to keep client data private and safely stored. However, cloud security also partially rests in the client’s hands as well. Understanding both facets is pivotal to a healthy cloud security solution.

As an overview, backend development against security vulnerabilities is largely within the hands of cloud service providers. Aside from choosing a security-conscious provider, clients must focus mostly on proper service configuration and safe use habits. Additionally, clients should be sure that any end-user hardware and networks are properly secured.

Cloud Architecture & Shared Responsibility Model

Security and Compliance is a shared responsibility. This shared model can help relieve the customer’s operational burden as AWS operates, manages and controls the components from the host operating system and virtualization layer down to the

physical security of the facilities in which the service operates. The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. Customers should carefully consider the services they choose as their responsibilities vary depending on the services used, the integration of those services into their IT environment, and applicable laws and regulations. The nature of this shared responsibility also provides the flexibility and customer control that permits the deployment. As shown in the chart below, this differentiation of responsibility is commonly referred to as Security “of” the Cloud versus Security “in” the Cloud.

Cloud Attack Surfaces & Entry Points

Let’s examine the cloud attack surface as part of our What is Attack Surface Management: Complete Guide and Best Practices guide.

The cloud attack surface includes all the internet-facing parts of your cloud setup. These are the systems attackers can find and try to exploit. It covers APIs, storage buckets, virtual machines, containers/k8s, identity tools, databases, and more.

In the cloud, everything is fast and decentralized. Services launch quickly, teams move fast, and many parts run across different regions and availability zones. This can make it difficult to track and secure everything simultaneously.

Gartner predicts that by 2025, 99% of cloud security issues will stem from inadequate setup and lack of customer knowledge.

Five Top Cloud Attack Surface Risks

These are the most common cloud attack surface management vulnerabilities that attackers exploit when cloud environments aren’t properly secured.

1. Misconfigured Cloud Storage

Cloud storage services, such as AWS S3, Google Cloud Storage, or Azure Blob, are used to store files, backups, and sensitive data. But if these storage buckets aren’t configured properly (e.g., left public by accident), anyone on the internet can access them. The

same logic applies to data warehouse and data lake providers.

In fact, in 2025, 82% of cloud breaches were linked to misconfigured services, with 23–31% of incidents traced to human error.

82 of cloud breaches were linked to misconfigured services.-17

1. Exposed APIs and Endpoints

APIs are the connection points between apps. In the cloud, they enable systems to communicate with each other.

But if these APIs aren’t secured with proper authentication, encryption, or rate limits, hackers can find them, flood them with requests, or even steal data.

1. Shadow Cloud Assets

Sometimes teams spin up cloud servers, apps, or databases without telling IT. These “shadow assets” don’t follow the same security checks and often go unnoticed or unpatched. Hackers look for these forgotten assets because they’re easy to exploit.

Studies show that 41% of employees use cloud apps and systems which are unknown to their IT department.

Physical networks — routers, electrical power, cabling, climate controls, etc.

Data storage — hard drives, etc.

Data servers — core network computing hardware and software

Computer virtualization frameworks — virtual machine software, host machines, and guest machines

Operating systems (OS) — software that houses

Middleware — application programming interface (API) management, Runtime environments — execution and upkeep of a running program

Data — all the information stored, modified, and accessed Applications — traditional software services (email, tax software, productivity suites, etc.)

End-user hardware — computers, mobile devices, Internet of Things (IoT) devices, etc.

Threat Landscape & OWASP IoT Top 10 :

OWASP Risk Cloud Application 1:2025 Broken Access Control

Misconfigured S3, public Azure Blob storage, lack of IAM boundaries 2:2025 Cryptographic Failures

Unencrypted S3 buckets, weak TLS configs, KMS keys with overly broad access 3:2025 Injection

Cloud-hosted APIs vulnerable to SQLi or command injection 5:2025 Security Misconfiguration

Default cloud accounts, open security groups, debug enabled in production 6:2025 Vulnerable & Outdated Components

Outdated container images, unpatched Lambda runtimes, EOL OS VMs 7:2025 Identification & Authentication Failures

Service account key leakage, weak token validation, credential reuse

Real-World Case Study / Attack Scenario

2012

Incident: A hacker obtained Dropbox user credentials through a third-party breach and accessed users’ cloud-stored files, exposing millions of accounts.

Response: A Dropbox investigation determined that usernames and passwords stolen from other websites were used to sign in to “a small number” of Dropbox accounts. The company contacted those users, offering to help them protect their accounts.

Aditya Agarwal, then VP of engineering at Dropbox, said: “A stolen password was also used to access an employee Dropbox account containing a project document with user email addresses. We believe this improper access is what led to the spam.” He added that Dropbox was putting additional controls in place to help make sure there was no repeat of the issue.

Incident: Snapchat’s cloud-based infrastructure was compromised due to vulnerabilities in the way it handled user data. Hackers exploited cloud systems and leaked millions of photos.

Response: In this data leak, often referred to as “The Snappening, Snapchat itself was not directly hacked. Instead, third-party apps that stored Snapchat photos were compromised. A spokesperson for the company said: “Snapchatters were victimised by their use of third-party apps to send and receive Snaps.

Uber (2016)

Incident: Hackers accessed Uber’s cloud-based storage and obtained personal data of 57 million users and drivers. Uber initially failed to report the breach.

Response: Uber executives eventually commented on the breach in 2017, but only after it had been made public. The transportation firm confirmed that 57 million accounts were compromised, including names, email addresses and phone numbers of users and drivers. Instead of reporting the breach at the time, Uber paid the hackers $100,000 under the guise of a bug bounty to delete the data and remain silent.

AWS S3 Breach (2017)

Incident: A massive data leak occurred when companies mistakenly left AWS S3 buckets publicly accessible. This exposed sensitive data such as customer information, internal business documents, and private communications.