Cyber Risk Management for the Internet of Things

Abstract

The Internet-of-Things (IoT) enables enterprises to obtain profits from data but triggers data protection questions and new types of cyber risk. Cyber risk regulations for the IoT however do not exist. The IoT risk is not included in the cyber security assessment standards, hence, often not visible to cyber security experts. This is concerning, because companies integrating IoT devices and services need to perform a self-assessment of its IoT cyber security posture. The outcome of such self-assessment need to define a current and target state, prior to creating a transformation roadmap outlining tasks to achieve the stated target state. In this article, a comparative empirical analysis is performed of multiple cyber risk assessment approaches, to define a high-level potential target state for company integrating IoT devices and/or services. Defining a high-level potential target state represent is followed by a high-level transformation roadmap, describing how company can achieve their target state, based on their current state. The transformation roadmap is used to adapt IoT risk impact assessment with a Goal-Oriented Approach and the Internet of Things Micro Mart model. The main contributions from this paper represent a transformation roadmap for standardisation of IoT risk impact assessment; and transformation design imperatives describing how IoT companies can achieve their target state based on their current state with a Goal-Oriented approach. Verified by epistemological analysis defining a unified cyber risk assessment approach. These can be used for calculating the economic impact of cyber risk; for international cyber risk assessment approach; for quantifying cyber risk; and for planning for impact of cyber-attacks, e.g. cyber insurance. The new methods presented in this paper for applying the roadmap include: IoT Risk Analysis through Functional Dependency; Network-based Linear Dependency Modelling; IoT risk impact assessment with a Goal-Oriented Approach; and a correlation between the Goal-Oriented Approach and the IoTMM model.

Strategy for Supply Chain Integration of Autonomous Electrical Vehicles in the Internet of Things

“…This research is part of research paper series related to this topic (Nicolescu, Huth, Radanliev, & De Roure, 2018b;Nurse, Radanliev, Creese, & De Roure, 2018;Petar Radanliev, 2019a, 2019b, 2014, 2015a, 2015c, 2015b, 2016Petar Radanliev et al, 2019;Petar Radanliev, Charles De Roure, Nurse, Burnap, & Montalvo, 2019;Petar Radanliev et al, 2019…”

“…; PetarRadanliev, Rowlands, & Thomas, 2014; Petar Radanliev, De Roure, Nurse, Montalvo, & Burnap, 2019a, 2019b Petar Radanliev, De Roure, Cannady, et al, 2019)(Nicolescu, Huth, Radanliev, & De Roure, 2018a; Petar Radanliev, De Roure, Nurse, Rafael, & Burnap, 2019; Petar Radanliev et al, 2019Taylor, P., Allpress, S., Carr, M., Lupu, E., Norton, J., Smith et al, 2018).…”

Cyber Risk in IoT Systems

“…Over-reliance on modelling in cyber insurance can also conceal insidious and difficult to detect processes [5], [26], such as in case of the 'normalization of deviance [4]. From a public policy point of view, it has been argued that insurers became 'de facto regulators' by establishing a minimum-security level to gain cyber coverage [13].…”

“…(4) Awareness and response strategies to common security threats such as Denial of Service, Worms/Trojans, Phishing, web-based and web application attacks, insider threat, exploit kits, information leakage, and identity theft [13], [22]. [23].…”

Cyber Risk impact Assessment - Assessing the Risk from the IoT to the Digital Economy

“…The aim of the research is to define how do we understand that we really understand cyber risk assessment. This approach was considered relevant to this question because most cyber security frameworks and methodologies propose answers to a quantitative question with qualitative assessments [3][4][5][6][7][8][9][10] .…”