# Cybersecurity Model Based on Hardening for Secure Internet of Things Implementation
## 1 Introduction  
The Internet of Things (IoT) is a set of interrelated electronic devices, mechanical and digital machines, objects, animals, or people that have unique identifiers. IoT can transfer data over a network without requiring human-to-human interaction or the interposition of a human being with a computer [1]. With the emergence of IoT, there are multiple devices connected to a telecommunication network, from household appliances to industrial machines. All these devices can be controlled remotely without requiring human presence or interaction. With the advancement and development of IoT, the study of autonomous device networks has been given more priority. However, IoT devices are expose to a series of threats. The most common threats are viruses and denial of service (DOS) attacks. Table 1 indicates the category of IoT attacks based on infrastructure components [2]. The exponential growth of IoT devices is surround by security and privacy risks. IoT implementations must be build ensuring easy and secure control [3]. The process of developing IoT systems requires in-depth knowledge in various areas, such as risks, threats, and vulnerabilities, to guarantee secure systems. By having massive IoT devices connected, cybersecurity measures must be defined to carry out an in-depth defense of the devices and information that are transmitted. To minimize threats in IoT, fluid policies must apply in the implementation processes. The International Telecommunication Union (ITU) defines cybersecurity as the set of tools, policies, security concepts, security safeguards, guidelines, risk management methods, actions, training, best practices, insurance, and technologies that can be used toprotect the assets of the organization and users in the cyber environment [4]. Cybersecurity in IoT is a factor that must be considered in the implementation and development of IoT devices, because an IoT device with its default configuration is a notorious victim for cybercriminals. In this same approach, Center for Internet Security (CIS) defines methodologies based on hardening that increase the security levels of different types of devices, which serve to mitigate the most attacks common against various information systems and networks. There are 20 CIS Controls that are classified as basic, foundational, and organizational that are applied to reduce the attack vectors of network, adjacent, local, and physical [5]. The hardening process needs a risk assessment to identify the points or elements where hardening should be implemented. So, in addition to the CIS Controls, there are standards that allow processes, such as risk assessment, information security management, and standardization of IoT architectures. One of the main organizations that is responsible for generating and standardizing these standards is the International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC). In the same way, ISO is a worldwide federation of national standards bodies that is responsible for developing international standards. The development of various standards is normally carried out through ISO technical committees. There are multiple ISO standards, such as the ISO/IEC 30,141, ISO/IEC 27,001, ISO/IEC 31,000, and ISO/IEC 25,010 standards, will be used as a basis. The ISO/IEC 30,141 standard is a reference architecture for IoT designers and developers. The ISO/IEC 27,001 standard is a guideline oriented to Information Security Management Systems (ISMS), which allows compliance with the confidentiality and integrity of ISMS [6]. The ISO/IEC 31,000 standard is a guide that makes it possible to measure the impact of different risks according to the type of activity to be carried out and according to the nature of the risk [7]. The ISO/IEC 25,010 standard is a model that allows the evaluation of product quality. The characteristics and quality properties of a software product are determined [8].