Honeynet para análisis, evaluación y tratamiento de riesgos cibernéticos en un sistema iot

Abstract

The security of home IoT systems is critical for protecting sensitive data and ensuring the integrity, availability, and confidentiality of information and devices. Nessus was utilized to analyze the vulnerabilities of the most common smart devices on the market. Based on these findings, a Honeynet was designed to expose these vulnerabilities and illustrate potential attacks on home IoT devices. Penetration tests were conducted to assess the security of devices within the home IoT system, as well as tests through the Honeynet, which included WiFi network hacking and control of IoT devices from the LAN. The honeypots deployed in the project are ConPot and CitrixHoneypot, which logged exploits of vulnerabilities CVE-2013-2566 and CVE-2015-2808. Additionally, a custom honeypot in Python was created to capture TCP SYN Flooding DoS attacks on port 6668/TCP utilizing the IRC service. The results of these tests were crucial in developing a risk treatment plan, based on a baseline model for data security, privacy of individuals, and IoT devices in home environments. A GAP analysis was conducted to determine the current state of the system. The risk treatment plan proposes specific controls and policies to mitigate identified risks and enhance the security of the IoT system, ensuring continuous and robust protection for IoT devices in smart homes.