IoT cyber risk: a holistic analysis of cyber risk assessment frameworks, risk vectors, and risk ranking process

Venkat P. Rangan,Krishnashree Achuthan,Kamalanathan Kandasamy,Sethuraman Srinivas

doi:10.1186/s13635-020-00111-0

Venkat P. Rangan, Krishnashree Achuthan + Show 2 more

Open Access

https://doi.org/10.1186/s13635-020-00111-0

Copy DOI

Abstract

Security vulnerabilities of the modern Internet of Things (IoT) systems are unique, mainly due to the complexity and heterogeneity of the technology and data. The risks born out of these IoT systems cannot easily fit into an existing risk framework. There are many cybersecurity risk assessment approaches and frameworks that are under deployment in many governmental and commercial organizations. Extending these existing frameworks to IoT systems alone will not address the new risks that have arisen in the IoT ecosystem. This study has included a review of existing popular cyber risk assessment methodologies and their suitability to IoT systems. National Institute of Standards and Technology, Operationally Critical Threat, Asset, and Vulnerability Evaluation, Threat Assessment & Remediation Analysis, and International Standards Organization are the four main frameworks critically analyzed in this research study. IoT risks are presented and reviewed in terms of the IoT risk category and impacted industries. IoT systems in financial technology and healthcare are dealt with in detail, given their high-risk exposure. Risk vectors for IoT and the Internet of Medical Things (IoMT) are discussed in this study. A unique risk ranking method to rank and quantify IoT risk is introduced in this study. This ranking method initiates a risk assessment approach exclusively for IoT systems by quantifying IoT risk vectors, leading to effective risk mitigation strategies and techniques. A unique computational approach to calculate the cyber risk for IoT systems with IoT-specific impact factors has been designed and explained in the context of IoMT systems.

Highlights

1.1 Internet of Things (IoT) technology IoT revolution of this millennium is the wave of technology that has impacted, and empowered every industry, since its initial formation in the year 1999 [1]
We present a critical analysis of cybersecurity risk assessment frameworks, their challenges, and perspectives for the future, with emphasis on industrial and healthcare sectors, the Internet of Medical Things (IoMT)
We focus mainly on National Institute of Standards and Technology (NIST), Operationally Critical Threat (OCTAVE), International Standards Organization (ISO), and Threat Assessment & Remediation Analysis (TARA) in this article

Summary

Introduction

1.1 IoT technology IoT revolution of this millennium is the wave of technology that has impacted, and empowered every industry, since its initial formation in the year 1999 [1]. Given the security vulnerabilities in modern IoT systems, it is important to holistically analyze cyber risk assessment frameworks, risk vectors, and risk ranking. Developing a computational approach for computing cyber risk for IoT systems is one of the goals of this research. Based on the literature review and analysis, a scientific approach to computing the cyber risk for IoT systems was designed as a part of this research, taking into consideration the IoT-specific impact factors. These factors were applied to compute the risk impact and likelihood of IoMT devices. The foundational aspects of cybersecurity risks are examined in this research through the lens of applicable theories including Dempster-Shafer theory and cybersecurity game theory

Cyber risks in the IoT domain

Integration in cloud

IoT layer with more

Findings

Conclusion