## 4 Discussion
Attack Complexity is based on the skill and knowledge required by the attacker to perform the attack. Vulnerabilities that require lower skills result in higher exploitability risk. The Privileges Required factor determines the level of privileges an attacker needs to successfully exploit the vulnerability. If the attacker requires elevated privileges or administrative access, the exploitability score will be lower. However, if the vulnerability can be exploited with low privileges or without any user interaction, the score will be higher. The User Interaction factor assesses whether user interaction is required for the vulnerability to be exploited. If the vulnerability can be exploited without user interaction, such as through automated means or remote attacks, the exploitability score will be higher. On the other hand, if user interaction is necessary, the score will be lower. \begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline
**Vulnerability** & **Attack vector** & **Complex.** & **Privil.** & **User** & **Impact** & **Severity score** & **Likelihood** & **Risk** \\ \hline Misconfiguration, & & & & & & & & \\ including configuration & & & & & & & & \\ errors, weak or missing & & & & & & & \\ security controls & & & & & & & \\ \hline Insider human & & & & & & & \\ vulnerability that results & & & & & & & \\ in evil twin attack & & & & & & & \\ \hline Access point & & & & & & & \\ misconfiguration that & & & & & & & \\ results in evil twin attack & & & & & & & \\ \hline Infrared LED & & & & & & & \\ communication & & & & & & & \\ \hline Vulnerabilities that result & & & & & & & \\ in Cyber Kill Chain & & & & & & & \\ \hline OEM firmware & & & & & & & \\ vulnerabilities & Remote & Low & Low & None & High & & & \\ \hline Weak security controls of & & & & & & & \\ the supply chain & & & & & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Severity and risk assessment of IoST vulnerabilities in air-gapped networks. The impact level depends on the amount of damage done due to a loss of confidentiality, integrity, and availability. A vulnerability that affects all CIA components translates to the highest exploitability risk. For simplicity, we map CVSS scores obtained using the CVSS v.3 calculator, which is measured in a range of 0 to 10, where 0 indicates no severity and 10 indicates the highest severity. Table 3 is also extended with two columns that are outside the scope of CVSS vulnerability assessment and identify the likelihood of the vulnerability being presented and the risk of having certain vulnerability exploited in the system, where Risk is a product of Likelihood and Impact, and Likelihood is a product of Threat and Vulnerabilities ((Risk = (Threat \(\times\) Vulnerabilities) \(\times\) Impact) [67]. Research questions regarding security measures and best practices for securing IoT devices and infrastructure were also answered during this study, and the key findings of the study can be found in Table 4.  
IoST devices in air-gapped networks are undoubtedly more secure because fewer attack vectors are available. However, this inherent isolation does not equate to absolute security or immunity from threats. It is a common misconception to assume that because these devices are not directly connected to external networks, they are inherently safe. To ensure the robustness of air-gapped infrastructure, organizations employing IoT devices must remain vigilant and proactive in addressing security concerns. This entails identifying and patching any potential security holes or vulnerabilities that may exist within these isolated networks. With exploitation techniques evolving all the time, it is very important to know the correct security posture of each IoT device. This can be achieved by implementing the recommended best security practices and measures, as outlined in this review. Regular