CIS Controls UAE

Capstone Project Assignment 49 Instructions: IoT Security Risk Assessment in UAE Smart Buildings General Assessment Guidance Your capstone project on topic of IoT Security Risk Assessment represents the complete summative assessment for this module, carrying 100% of the marks. All submissions must be made through Turnitin online access only; email, USB, or hard copy submissions are not accepted. The expected word count for this project is 8,000 to 10,000 words, excluding front matter, references, and appendices. Submissions outside this range may be subject to mark adjustments. Ensure that your Student Reference Number (SRN) appears on all pages, and do not include personal identifying information. A total of 100 marks is available, with a minimum threshold of 50% required to pass. The Harvard Referencing System must be applied consistently; failure to reference sources correctly will be treated as plagiarism. Use of AI is allowed only for language correction, grammar checks, or minor draft refinement. All conceptual analysis, data interpretation, and recommendations must reflect your own critical thinking. A completed Assignment Cover Sheet is mandatory; omission may invalidate the submission. Assessment Brief This project requires the development of a consultancy-style report investigating IoT security risks in smart buildings across the UAE. The client may be a private smart building developer, a government digital infrastructure authority, or an IoT solutions provider. Your project should explore: Identification of key IoT security vulnerabilities in smart building infrastructures in the UAE, including sensors, connected devices, and cloud-based building management systems. Evaluation of risk assessment frameworks, such as NIST Cybersecurity Framework, ISO/IEC 27001, or CIS Controls, applied in UAE contexts. Analysis of potential impacts of security breaches, including data compromise, operational disruption, or reputational damage. Comparison of public and private sector implementations of IoT security measures within UAE free zones, high-rise commercial towers, and residential complexes. Students are expected to use secondary sources such as peer-reviewed journals, industry security audits, government publications, and white papers from reputable cybersecurity organizations. Your analysis should link technical risks to strategic outcomes, demonstrating how IoT security affects stakeholder confidence, regulatory compliance, and operational efficiency. Learning Outcomes Upon completing this capstone project, students will be able to: LO1: Develop a strategically significant research project assessing IoT security risks in UAE smart buildings. LO3: Apply risk assessment methodologies appropriate to IoT and smart building ecosystems. LO4: Formulate evidence-based recommendations to strengthen security posture, operational resilience, and compliance adherence. Key Areas to Cover Executive Summary Introduction: IoT in UAE Smart Buildings Challenges and Security Issues Purpose and Objectives of the Risk Assessment Analytical Evaluation using Secondary Data Recommendations and Strategic Conclusions The report must demonstrate understanding of cybersecurity frameworks, IoT device vulnerabilities, risk prioritization techniques, and UAE-specific regulatory requirements, linking theoretical concepts to practical scenarios. Report Structure Academic Integrity Declaration Page Title Page Table of Contents List of Figures, Tables, and Abbreviations (if required) Executive Summary Introduction: Context of UAE IoT-enabled Smart Buildings Challenges and Security Issues Purpose and Scope of the Risk Assessment Analytical Evaluation using Secondary Data Recommendations and Strategic Conclusions Harvard References Appendices (if applicable) Total Length and Word Count Allocation (Approximate) Executive Summary – 700 words Introduction – 1,500 words Challenges and Security Issues – 1,800 words Purpose and Risk Assessment Scope – 600 words Analytical Evaluation – 3,000 words Recommendations and Strategic Conclusions – 1,400 words Total: 8,000–10,000 words Executive Summary Guidelines The executive summary (approx. 700 words) should provide a concise synthesis of the full report, covering: Key IoT security risks in UAE smart buildings Purpose and objectives of the risk assessment Summary of analytical evaluation findings Evidence-based recommendations for mitigation strategies For merit-level submissions, include a detailed outline of risk assessment methodology. For distinction-level work, justify why IoT security is strategically critical for UAE smart building projects, demonstrating awareness of both technical and business implications. Section Guidelines Introduction: Context of UAE IoT-enabled Smart Buildings Explain the rapid expansion of IoT in UAE buildings, considering: Smart city initiatives and government strategies promoting IoT integration (e.g., Dubai Smart City, Abu Dhabi’s digital infrastructure programs). Variety of connected devices: building management systems, HVAC sensors, lighting controls, security cameras, and access control systems. Relevance of IoT security to stakeholder trust, operational efficiency, and regulatory compliance. Examples of UAE smart buildings implementing IoT successfully and the associated security practices adopted. This section should establish the rationale for the risk assessment, connecting IoT security to business and regulatory priorities. Challenges and Security Issues Identify and analyse security vulnerabilities and challenges in UAE smart buildings, including: Device-level risks: default credentials, unpatched firmware, weak encryption protocols Network risks: insecure Wi-Fi, IoT device network segmentation failures Data risks: exposure of sensitive operational or occupant data, privacy compliance issues Operational risks: potential service disruption due to cyberattacks Regulatory gaps: inconsistent application of cybersecurity standards in UAE construction and real estate sectors Use case studies or documented breach incidents where applicable, and highlight differences between private sector, government-managed, and free zone projects. Purpose and Risk Assessment Scope Clearly articulate the study’s purpose, which may include: Identifying high-priority IoT security risks in smart buildings Evaluating the effectiveness of existing security controls and mitigation strategies Benchmarking UAE smart building security practices against global IoT standards Providing guidance for risk mitigation in both public and private contexts This section should emphasize why IoT security assessment is essential, linking it to operational resilience, regulatory adherence, and stakeholder confidence. Analytical Evaluation Using Secondary Data Perform a critical analysis using secondary sources to evaluate: IoT security frameworks applied in UAE smart buildings (NIST CSF, ISO/IEC 27001, CIS Controls) Vulnerability patterns and threat vectors reported in academic and industry studies Comparative performance of public vs. private sector smart buildings Limitations of available data, such as underreporting, security confidentiality, or lack of standardized audits Apply structured evaluation methods, such as risk scoring matrices, threat likelihood-impact analysis, or cybersecurity maturity models, to provide robust insights. Recommendations and Strategic Conclusions Provide actionable recommendations, including: Technical measures: device hardening, secure communication protocols, regular firmware updates Organizational policies: incident response planning, cybersecurity awareness training, vendor management Strategic measures: adopting … Read more