期刊名称：Journal of Digital Forensics, Security and Law
印刷版ISSN：1558-7215
电子版ISSN：1558-7223
出版年度：2021
卷号：16
期号：1
页码：2-20
DOI：10.15394/jdfsl.2021.1695
出版社：Association of Digital Forensics, Security and Law
摘要：The technology used in drones is similar or identical across drone types and components, with many common risks and opportunities. The purpose of this study is to enhance the risk assessment procedures for Drone as a Service (DaaS) capabilities. STRIDE is an acronym that includes the following security risks: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privileges. The paper presents a modified STRIDE threat model and prioritize its desired properties (i.e., authenticity, integrity, non-reputability, confidentiality, availability, and authorization) to generate an appropriate DaaS threat model. To this end, the proposed DIREST threat model better meets the overall security assessment needs of DaaS. Moreover, this paper discusses the security risks of drones, identifies best practices for security assessment, and proposes a novel software update mechanism for drones during their operations. We explore best practices related to drone penetration testing, including an effective methodology to maintain continuity of drone operation, particularly drones used for emergency, safety, and rescue operations. Moreover, this research raises awareness of DaaS and drone operation in general as well as in the forensic science community due to its focus on the importance of securely operated drones for first responders. Furthermore, we address various aspects of security concerns, including data transmission, software restrictions, and embedded system-related events. In order to propose a security assessment for drones, we incorporate digital forensics and penetration testing techniques related to drone operations. Our results show that the proposed threat model enhances the security of flying devices and provides consistency in digital forensic procedures. This work introduces modifications to the STRIDE threat model based on the firmware analysis of a Zino Hubsan brand drone.
关键词：UAV Security; Drone as a Service; Daas; Drone Forensic; Penetration testing; Firmware Analysis; Threat Modeling
