# Cybersecurity Model Based on Hardening for Secure Internet of Things Implementation
## 4 Proposed Solution
### Step 2. Risk Assessment  
There are multiple operations and objectives served by IoT systems. A risk assessment is needed to determine the impacts involving the system. OWASP IoT Top 10 [9] proposes the most common vulnerabilities in IoT systems; see Table 5.  
Depending on the application of the IoT system, a risk assessment may require a higher compliance class to mitigate the determined level of risk. The compliance classes are based on the confidentiality, integrity, and availability (CIA triad) levels of the IoT system [46]. Confidentiality protects information of the IoT system. Integrity maintains the original properties of IoT system against unauthorized access. Availability ensures that IoT system are accessible at any time to authorized elements [47]. The risk impact is calculated with the levels of the CIA triad generating compliance classes. Class 0 has the lowest impact, and class 4 has the highest impact. The compliance classes were weighted from 1 to 5, representing the risks of the CIA triad; see Table 6.  
For calculating the risk of all vulnerabilities in the OWASP IoT Top 10 project by summing the compliance class score and the probability of incidence, we propose the matrix of risk in Figure 7.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Compliance Classes** & **Description** & **Confidentiality** & **Integrity** & **Availability** & **Score** \\ \hline \multirow{2}{*}{Class 0} & An imperceptible impact could & \multirow{2}{*}{Low} & \multirow{2}{*}{Low} & \multirow{2}{*}{Low} & \multirow{2}{*}{Low} & \multirow{2}{*}{1} \\  & happen in the IoT system. & & & & \\ \hline \multirow{2}{*}{Class 1} & The impact that could occur on the & \multirow{2}{*}{Low} & \multirow{2}{*}{Medium} & \multirow{2}{*}{Medium} & \multirow{2}{*}{2} \\  & IoT system is limited. & & & & \\ \hline \multirow{2}{*}{Class 2} & Besides to class 1, the IoT system & \multirow{2}{*}{Medium} & \multirow{2}{*}{Medium} & \multirow{2}{*}{High} & \multirow{2}{*}{3} \\  & & to availability. & & & \\ \hline \multirow{2}{*}{Class 3} & Besides to class 2, the IoT system & \multirow{2}{*}{High} & \multirow{2}{*}{Medium} & \multirow{2}{*}{High} & \multirow{2}{*}{4} \\  & protect sensitive data. & & & & \\ \hline \multirow{2}{*}{Class 4} & Besides to class 3, data compromise & \multirow{2}{*}{High} & \multirow{2}{*}{High} & \multirow{2}{*}{High} & \multirow{2}{*}{5} \\  & and loss of control have a critical & & & & \\ \multicolumn{4}{c}{impact on the IoT system.} & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 6: Compliance class associated with confidentiality, integrity, and availability (CIA).  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Top** & **Vulnerability** \\ \hline
1 & Weak, guessable, or hardcoded passwords \\ \hline
2 & Insecure network services \\ \hline
3 & Insecure ecosystem interfaces \\ \hline
4 & Lack of secure update mechanism \\ \hline
5 & Use of insecure or outdated components \\ \hline
6 & Insufficient privacy protection \\ \hline
7 & Insecure data transfer and storage \\ \hline
8 & Lack of device management \\ \hline
9 & Insecure default settings \\ \hline
10 & Lack of physical hardening \\ \hline \hline \end{tabular}
\end{table}
Table 5: Top ten attacks in IoT systems.  
The result of the risk value should have a scale from 1 to 10 according to the Euclidean standard [48]. The elements of the scale to classify the risk are critic, high, medium, low, and null; see Table 7.