## 6 Lab-Built Scenario and Benchmarking
### Quantitative Benchmarking Results  
Our experimental results, derived from testing on NVIDIA Orin devices, provide quantitative evidence of the significant security improvements achieved by applying the AZTRM-D framework. Table 4 summarizes these findings, demonstrating a substantial reduction in the attack surface and a measurable increase in overall security resilience compared to a factory default configuration. For open network ports, in the baseline (factory default NVIDIA Orin) configuration, our reconnaissance consistently identified 4 common open network ports, including SSH (Port 22), VNC (Port 5900), and often web services (HTTP/HTTPS on Ports 80/443). These exposed ports represent direct remote attack vectors, allowing adversaries to probe for vulnerabilities and attempt initial access. In stark contrast, the AZTRM-D hardened configuration for the NVIDIA Orin successfully eliminated all external network exposure, resulting in 0 open network ports. This complete removal of the network attack surface is a critical achievement for edge devices like the Orin, significantly reducing the opportunities for remote exploitation. Regarding initial external access time, for the baseline NVIDIA Orin (NVIDIA Corporation, Santa Clara, CA, USA), initial external access was achieved remarkably quickly, in less than 5 min. This rapid compromise was primarily due to the widespread knowledge of default credentials (like nvidia:nvidia) and, crucially, the absence of account lockout mechanisms on the default SSH daemon. This allowed for highly efficient brute-force attacks in a lab environment. However, with the AZTRM-D hardened configuration, \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Security Metric** & **Baseline (Factory Default NVIDIA Orin)** & **AZTRM-D Hardened Configuration (NVIDIA Orin)** \\ \hline Open Network Ports & 4 Ports (SSH, VNC, HTTP, HTTPS) & 0 Ports (Complete elimination of network attack surface). \\ \hline Initial Access Time (External) & \begin{tabular}{l} \(<\)5 min (via default credential brute-force). \\ \end{tabular} & \begin{tabular}{l} Not Possible (No remote or physical vectors found). \\ \end{tabular} \\ \hline Privilege Escalation & Immediate (single sudosu command from default nvidia user). & Blocked (Requires explicit, multi-step validation; default paths removed). \\ \hline Vulnerability Detection Rate (CI/CD) & \begin{tabular}{l} 0\% (No automated scanning integrated into development pipeline). \\ \end{tabular} & \begin{tabular}{l} 98\% (Automated SAST, DAST, SCA, CSPM, and IaC scans). \\ \end{tabular} \\ \hline Mean Time to Remediate (MTTR) & \begin{tabular}{l} Weeks to Months (Manual patching, firmware updates, or re-flashing). \\ \end{tabular} & \
\begin{tabular}{l} 1-3 days (Automated alerting and patching pipeline, with AI-driven remediation or automated rollback). \\ \end{tabular} \\ \hline Supply Chain Vulnerability & High (No dependency scanning or artifact signing for device software). &
\begin{tabular}{l} Low (Mandatory SBOM validation and cryptographic signing for all software components). \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Quantitative Benchmarking of AZTRM-D Security Improvements on NVIDIA Orin Devices. achieving external access became not possible. Our comprehensive testing, encompassing both remote network and direct physical attack vectors (after SD card encryption and GPIO pin hardening), failed to yield any viable entry points, demonstrating the framework's robust defense-in-depth. In terms of privilege escalation, in the factory default NVIDIA Orin setup, privilege escalation was immediate. Once initial access was gained as the nvidia user, the default sudo configurations allowed for a single sudo su command to gain full root privileges. This represented a critical vulnerability, as any compromise of the default user instantly led to complete system control. Conversely, the AZTRM-D hardened configuration effectively blocked trivial privilege escalation.