METHODOLOGY FOR QUANTITATIVE SECURITY ASSESSMENT AND PRACTICAL VERIFICATION OF SMART HOME SYSTEMS PROTECTION METHODS
Abstract
Topicality. The growth of the number of interconnected IoT devices in smart home systems, the heterogeneity of communication protocols, the use of cloud services, and the presence of vulnerabilities at the device, network, software, and data processing levels necessitate a quantitative assessment of the level of cybersecurity of Smart Home systems. An analysis of the ETSI EN 303 645, NISTIR 8259A, NIST Cybersecurity Framework 2.0, NIST SP 800-207 standards, and OWASP recommendations showed that they form a normative and methodological basis for ensuring IoT security, but do not define a universal integral indicator for quantitatively comparing specific configurations of smart home systems. The subject of the study is methods and tools for quantitatively assessing the level of cybersecurity of smart home systems, taking into account the characteristics of authentication and access control, communications, firmware and updates, data protection and privacy, monitoring and incident detection, as well as resilience and recovery. The purpose of the article is to develop and practically test a methodology for quantitatively assessing the level of cyber security of Smart Home based on the integral Security Protection Index (SPI), as well as determining the effectiveness of protection mechanisms of various IoT communication protocols and multi-level security architecture. Results are obtained. An SPI methodology is proposed, which involves assessing six security domains and using a five-level maturity scale ML-0–ML-4 for a differentiated determination of the actual level of implementation of protection mechanisms. A comparative evaluation of the ZigBee, Z-Wave Security S2 and MQTT protocols was carried out using ten security criteria. The highest integral indicator was obtained for Z-Wave Security S2 – 4.76 points. Five typical cyberattack scenarios were additionally simulated and the effectiveness of multi-level protection using network segmentation, cryptographic mechanisms, access control, monitoring and the Zero Trust approach was assessed. Conclusion. The results of the study confirm the feasibility of using SPI as a tool for quantitative comparison and assessment of the level of cybersecurity of smart home systems. The proposed approach provides a more differentiated assessment compared to the binary model "secured/unsecured" and can be used to select protocols, identify weaknesses in the Smart Home infrastructure, and justify a set of measures to increase its cyber resilience.