Mohamad Talagi

تخصص الأمن السيبراني · دفعة 2026

Raqib – An Automated IoT Security Assessment and NCA Compliance Platform

Raqib is an AI-assisted IoT security compliance and risk-assessment platform. Its control design and evidence-collection scope are grounded in two frameworks: the Saudi National Cybersecurity Authority's CGIoT-1:2024 IoT guidelines, formally implemented end-to-end as an 81-guideline compliance module, and the OWASP IoT Top 10, which informs the vulnerability categories the platform's collectors target (default/hard-coded credentials, insecure network services, insecure protocols, lack of secure update mechanisms). To build and validate the auditor without touching real infrastructure, we built a Docker-based simulated IoT test lab – a testing-only harness used purely for development and verification, never part of the production system – modeling eight devices across three security postures (insecure, partially hardened, hardened) plus five additional device types, each grounded in real, CVE-documented vendor products. Against this lab, a worker service collects deterministic, hashed, reproducible evidence: network/service discovery, default-credential and protocol testing (MQTT, TLS), packet capture, and firmware SBOM/CVE analysis. The actual deliverable is the auditor platform itself: two centralized Python policy engines evaluate collected evidence – an original five-control pilot and the full CGIoT-1:2024 evaluator – producing explainable Pass/Fail/Partial/Inconclusive/Not-Applicable verdicts, never an AI-made decision. A seven-factor dynamic risk engine, CISA-KEV-enriched vulnerability intelligence, and human-reviewed Gemini-generated remediation blueprints feed a deterministic executive summary and exportable PDF/HTML/JSON reports with full evidence provenance, presented through a React/FastAPI/PostgreSQL dashboard. It is explicitly labeled an alignment tool, never an NCA certification.

اقرأ التقرير النهائي (PDF)