# A Simple Experimental Stand for Studying the Network Security Level of Power Electronic Devices
## 7 Analysis and Recommendations  
The last stage of the developed methodology is the analysis of the obtained results and proposed recommendations for enhancing the network security level. Both PDUs have only one open port. This is great because the administrator of the network to which these devices would eventually connect, does not have to deal with additional activities involved in restricting access to the possible open ports. In the case of the two studied devices, no such activities would be required due to the presence of only one open port.  
In terms of data exchange, both devices do not have any data encryption because they use http instead of https. As it can be seen from the presented results, for both devices the information is not transmitted securely--either in plain text, when exchanging statistical data such as values of the current, voltage, temperature, humidity, etc., or using simple encoding, which is very easy to decode. In both devices, the procedure for changing username and password is exchanged in plain text. Credential information can thus very easily be intercepted in the subsequent analysis of the intercepted packets. To remedy this deficiency both devices must be accessed using the VPN technology. Thus, the information exchange will be encrypted and cannot be read. The use of VPN for both devices is imperative because they are used in remote power supply management of various network devices and servers. If these PDUs are hacked, the performance of the ISP network may be questionable.  
The results from the penetration tests show that the EATON PDU is inaccessible during all TCP DoS attacks. In contrast to the EATON PDU, the Neomonata PDU is only inaccessible during the TCP SYN attack, and accessible during the other attacks. This was further demonstrated during the analysis of both devices using the network vulnerability analysis scripts via the Nmap tool. The results for the EATON PDU showed that the device was vulnerable to DoS attacks, which was proven by the penetration tests performed. The Neomonata PDU analysis, with the same scripts, showed that the device may not be susceptible to DoS attacks. This was also proven by the penetration tests performed, at which time it was seen that only during the TCP SYN attack was the device inaccessible. During the other three TCP DoS attacks the device was accessible. This means that the embedded web server is somehow designed to be able to resist to some of the DoS attacks. For both devices, additional measures must be taken to be secured against DoS attacks, such as the following:  
* Segmenting the network by creating VLANs and using hardware firewalls;
* Load balancing--distributing traffic across multiple servers;  
Figure 51: Processed traffic from the Neomonata PDU during all attacks.  
* Blocking traffic from known or suspected IP addresses that have been linked to DoS attacks in the past or present;
* Limiting the speed of traffic, which can prevent a DoS attack from overloading the server;
* Using content delivery networks (CDNs)--this distributes the content of the website across multiple locations; thus, a DoS attack could not bring down the entire site.  
Additional measures and techniques that can be applied to enhance network security are outlined in [40; 41; 42; 43; 44; 45; 46; 47; 48; 49].