Consumer, commercial, and industrial IoT (in)security: attack taxonomy and case studies

Christos Xenofontos, Ioannis Zografopoulos, Charalambos Konstantinou*, Alireza Jolfaei, Muhammad Khurram Khan, Kim Kwang Raymond Choo

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

62 Citations (Scopus)


Internet of Things (IoT) devices are becoming ubiquitous in our lives, with applications spanning from the consumer domain to commercial and industrial systems. The steep growth and vast adoption of IoT devices reinforce the importance of sound and robust cybersecurity practices during the device development life cycles. IoT-related vulnerabilities, if successfully exploited can affect, not only the device itself but also the application field in which the IoT device operates. Evidently, identifying and addressing every single vulnerability are an arduous, if not impossible, task. Attack taxonomies can assist in classifying attacks and their corresponding vulnerabilities. Security countermeasures and best practices can then be leveraged to mitigate threats and vulnerabilities before they emerge into catastrophic attacks and ensure overall secure IoT operation. Therefore, in this article, we provide an attack taxonomy, which takes into consideration the different layers of the IoT stack, i.e., device, infrastructure, communication, and service, and each layer's designated characteristics, which can be exploited by adversaries. Furthermore, using nine real-world cybersecurity incidents that had targeted IoT devices deployed in the consumer, commercial, and industrial sectors, we describe the IoT-related vulnerabilities, exploitation procedures, attacks, impacts, and potential mitigation mechanisms and protection strategies. These (and many other) incidents highlight the underlying security concerns of IoT systems and demonstrate the potential attack impacts of such connected ecosystems, while the proposed taxonomy provides a systematic procedure to categorize attacks based on the affected layer and corresponding impact.

Original languageEnglish
Pages (from-to)199-221
Number of pages23
JournalIEEE Internet of Things Journal
Issue number1
Publication statusPublished - 1 Jan 2022


  • attacks
  • Internet of Things (IoT)
  • security
  • taxonomy


Dive into the research topics of 'Consumer, commercial, and industrial IoT (in)security: attack taxonomy and case studies'. Together they form a unique fingerprint.

Cite this