# Cybersecurity Model Based on Hardening for Secure Internet of Things Implementation
## 5 Case Study
### Step 6. Hardening Process  
The obtained values of risk, attack surface and CVSSv3 indicate that the IoT system has a maturity level equal to 1; see Table 19. The hardening process should be applied, changing the ports to a different range of known ports, and patching the vulnerabilities. The risks found in the attack surface were mitigated through the hardening process. The hardening process performed in this environment was to change the number of ports of the services found with the port scan. Ports were changed to a different port range from the known ports. Arduino Mega 2560 firmware was updated. The hardening guide CIS Debian Linux 9 Benchmark [60] was applied to the Raspberry Pi 3B + operating system. This hardening guide focuses on disable unused filesystems, configure software updates, filesystem integrity checking, secure boot settings, access control, warning banners, network configuration, disable danger network protocols, configure firewall, logging and auditing, system file permissions, users, and group settings. Virtual Local Area Networks (VLANs) and Access Control Lists (ACL) were applied on the network device used. With the ACL created only the management VLAN can have remote access to the Arduino Mega 2560 and the Raspberry Pi 3B+. A pool was created with the Media Access Control Address (MAC) of the embedded systems. A policy was created to block the network interface when connecting a device that does not have its MAC registered in the pool. Virtual management network was created that is the only one that has access to the IoT devices; see Figure 12. Additionally, the process of hardening the system and the updates of the services was carried out, thus mitigating the vulnerabilities found; see Table 18.  
The IoT system is no longer susceptible to OWASP IoT Top 10 vulnerabilities. The calculated risk is in the null category; see Table 20.  
The aim of this step is to use communication protocols that have an adequate level of encryption and do not involve risks in their implementation. There are communication protocols that do not have an adequate level of security. Changing the port number of the protocols that will be used reduces the probability of a threat occurring on the attack surface. When using a range of ports different from the range of known ports, it is more difficult to determine which port is open and which service it hosts; see Table 21.  
Figure 12: VLANs created for hardening process. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**Risk** & **Attack Surface (AS)** & **Vulnerability CVSSv3 (V)** & **Maturity Level** \\ \hline
7 & 7.3 & 7.5 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 19: IoT system mature levels. The ports were changed to a different range of known ports. When performing the recognition with the Nmap tool, it was validated that the proposed solution is effective because it was not possible to identify any exposed port in the IoT devices, as indicated in Table 22; see Figure 13.  
Using the new values of the risk in each step, we proceeded to calculate the attack surface in each layer of the IoT system; see Table 23. \begin{table}
\begin{tabular}{c c c c} \hline \hline
**OWASP IoT Top 10 Vulnerabilities** & **Compliance Class Score** & **Probability** & **Risk Result** \\ \hline Weak, guessable, or hardcoded & & & \\ passwords & 1 & 0 & 1 \\ \hline Insecure network services & 2 & 0 & 2 \\ \hline Insecure ecosystem interfaces & 2 & 0 & 2 \\ \hline Lack of secure update mechanism & 1 & 1 & 2 \\ \hline Use of insecure or outdated & & & \\ components & 1 & 0 & 1 \\ \hline Insufficient privacy protection & 1 & 0 & 1 \\ \hline Insecure data transfer and storage & 1 & 1 & 2 \\ \hline Lack of device management & 1 & 0 & 1 \\ \hline Insecure default settings & 1 & 0 & 1 \\ \hline Lack of physical hardening & 1 & 0 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 20: Case study risk post-hardening. \begin{table}