A Survey on Cyber Risk Management for the Internet of Things

Parsons, Emily Kate; Panaousis, Emmanouil; Loukas, George; Sakellari, Georgia

doi:10.3390/app13159032

Cited by 1 publication

(1 citation statement)

References 89 publications

(503 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Furthermore, research is underway on context-based adaptive RMF, which offers a more flexible, simpler, and easily implementable alternative to complex frameworks [7]. In the field of the IoT, [8] studied the IoT cyber risk management framework for human-centered vulnerabilities.…”

Section: Rmf (Risk Management Framework)mentioning

confidence: 99%

A Study on the Multi-Cyber Range Application of Mission-Based Cybersecurity Testing and Evaluation in Association with the Risk Management Framework

Kim,

Park,

Lee

et al. 2023

Information

View full text Add to dashboard Cite

With the advancement of IT technology, intelligent devices such as autonomous vehicles, unmanned equipment, and drones are rapidly evolving. Consequently, the proliferation of defense systems based on these technologies is increasing worldwide. In response, the U.S. Department of Defense is implementing the RMF (Risk Management Framework) to ensure the cybersecurity of defense systems and conducting cybersecurity T&E (test and evaluation) concurrently. However, RMF and cybersecurity T&E conducted during the acquisition phase of defense systems often result in fragmented cybersecurity assessments, excluding the operational environment of the defense systems. This omission fails to account for the complex network integration, data exchange functionalities, and mission-specific requirements in actual cyber attack scenarios. For these reasons, vulnerabilities in defense systems that remain unidentified during the acquisition phase can potentially pose significant cybersecurity threats during operational phases, necessitating substantial costs and efforts for remediation. Therefore, this paper proposes a mission-based cybersecurity T&E model using a Multi-Cyber Range to effectively apply these two systems in a practical manner. The Multi-Cyber Range integrates independently operated cyber ranges into a network to expand the evaluation environment, which better reflects the mission environment of defense systems. The proposed model’s effectiveness is validated using a cyber attack simulation system targeting a virtualized arbitrary defense system. This paper not only presents an enhanced model for mission-based cybersecurity T&E, but also contributes to the advancement of cybersecurity T&E methodologies by providing a concrete application process.

show abstract

Section: Rmf (Risk Management Framework)mentioning

confidence: 99%