Future developments in standardisation of cyber risk in the Internet of Things (IoT)

Abstract

In this research article, we explore the use of a design process for adapting existing cyber risk assessment standards to allow the calculation of economic impact from IoT cyber risk. The paper presents a new model that includes a design process with new risk assessment vectors, specific for IoT cyber risk. To design new risk assessment vectors for IoT, the study applied a range of methodologies, including literature review, empirical study and comparative study, followed by theoretical analysis and grounded theory. An epistemological framework emerges from applying the constructivist grounded theory methodology to draw on knowledge from existing cyber risk frameworks, models and methodologies. This framework presents the current gaps in cyber risk standards and policies, and defines the design principles of future cyber risk impact assessment. The core contribution of the article therefore, being the presentation of a new model for impact assessment of IoT cyber risk. Keywords: Cyber risk; Internet of Things cyber risk; Internet of Things risk vectors;Standardisation of cyber risk assessment; Economic impact assessment. University of OxfordUniversity of Oxford 3 analysis to uncover the best method to define a unified cyber risk assessment. In section 7 we propose a new epistemological framework for cyber risk assessment standardisation and we discuss the new impact assessment principles. In Section 8 we present the conclusions and limitations of the research. METHODOLOGYThe methods applied in this study consist of literature review, comparative study, empirical analysis, theoretical and epistemological analysis and case study workshops. The selection of methodologies is based on their flexibility to be applied simultaneously to analyse the same research topic from different perspectives. We use practical studies of major projects in the I4.0 to showcase recent developments of IoT systems in the context of I4.0 high-tech strategies. We need practical studies to bridge the gaps, to assess the impact and overcome some of the cyber risk limitations and to construct the relationship between IoT and high-tech strategies. The proposed design principles support the process of building a holistic IoT cyber risk impact assessment model. Theoretical analysisThe methodology applies theoretical analysis through logical discourse of knowledge, also known as epistemological analysis. An epistemological analysis enables an investigation on how existing knowledge is justified and what makes justified beliefs justified (Steup, 2005), what does it mean to say that we understand something (Wenning, 2009) and how do we understand that we understand.The methodology reported here has two objectives. The first objective is to enable an up-todate overview of existing and emerging cyber risk vectors from IoT advancements, which includes cyber-physical systems, the industrial Internet of things, cloud computing and cognitive computing (MEICA, 2015;Weyer et al., 2015;Liao et al., 2017). If we were performing a vector specific analysis of r...

Artificial Intelligence, Machine Learning and Real-time Probabilistic Data for Cyber Risk (Super) -forecasting: Red Teaming the Connected World (RETCON)

“…Many similar models have been introduced and never used because reliable data could not be found. Furthermore, in terms of the (un)availability of data, lessons can be learned from previous research on data strategies [39]. The volume of data generated creates diverse challenges for developing data strategies in a variety of verticals (ex.…”

Definition of Internet of Things (IoT) Cyber Risk – Discussion on a Transformation Roadmap for Standardisation of Regulations, Risk Maturity, Strategy Design and Impact Assessment

“…Notable for this discussion, only FAIR 38 provides recommendations for quantitative risk estimation. To complete the risk assessment, the cyber risk from supply chains needs to be simplified 31,42,43 . To identify a current cyber risk state that includes supply chain cyber risks, the Exostar system 36 , can be used for complimenting the CVSS and covering the supply chain aspect of cyber risk.…”

“…To identify a current cyber risk state that includes supply chain cyber risks, the Exostar system 36 , can be used for complimenting the CVSS and covering the supply chain aspect of cyber risk. Further analysis, including SWAT and GAP analysis are considered beyond the scope of this conference paper, but can be found in other articles [43][44][45][46][47] .…”

“…The rationale is that different enterprises will have different cyber security steps to perform in order to transition to a higher maturity lever. A long and detailed list of steps can be found in some of our work in progress articles 42, 43,46 . For implementing the recommendations emerging from the transformational imperatives, we refer to the NIST cyber security implementation tiers as support guidance.…”

Supply Chain Systems Architecture and Engineering Design: Green-Field Supply Chain Integration

“…Further research is required into the topic of addressing strategy absence, because in such scenarios, the formulation would be difficult to implement. A series of publications follows this research 1,2,[11][12][13][14][15][16][17][18][19][20]3,[21][22][23][24][25][26][27][28][29][30]32…”