Week 9: Threat Modeling and IoT Security

This week asks a different security question:

What should we protect first when we cannot protect everything equally?

Garden State Cyber I introduces threat modeling through home Internet of Things systems such as cameras, routers, smart speakers, baby monitors, and other connected devices.

This week

Lesson 1: Threat Modeling: Decide What Deserves Protection

Build an asset, trust-boundary, threat, weakness, impact, control, and residual-risk model. Rate likelihood, impact, and confidence instead of treating every scenario as equally urgent.

Lesson 2: IoT Security: The Device Is Only One Part of the System

Expand the system boundary to include firmware, mobile apps, cloud services, routers, accounts, privacy, updates, and network trust.

Lesson 3: Home IoT Risk Game: Spend Your Defenses Wisely

Use a fictional smart home, threat cards, and a limited defense budget to prioritize controls. Then revise the threat model when one assumption changes.

What you will produce

• threat-model diagram
• prioritized risk table
• IoT data-flow diagram
• four-device comparison
• 10-point defense budget
• My IoT Threat Model worksheet

The goal is not to eliminate every risk.

It is to make a defensible decision about which risks matter most, which controls reduce them, and what residual risk remains.