# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 4 Challenges in Performing Risk Assessment in MIoT
### Discussion  
A substantial amount of research has addressed the difficulties posed by _quantifying risk_, a common theme with regard to risk in general. There are also attempts to integrate risk frameworks with cyber security catalogues, usually maintained by the community, that update discovered vulnerabilities, so that managers can take preventive actions to tackle cyber-attacks. We have summarised vital factors when tackling dynamic RA in MIoT ecosystems, as follows:  
* Improvement in the identification of the potential attack surface posed by dynamic IoT-based assets in complex networks [35]. * Tackling the dynamics and temporality of transient and intermittent behaviours characteristic of MIoT environments. Account for the inherent complexities of performing these tasks in (near) real-time settings. * Adherence to MIoT/IoT-specific guidance and regulations, aligning them to hospital technologies, equipment and communication protocols. * One interesting approach supported by OWASP is to employ a tool called pytm (OWASP pytm, a Pythonic framework for TM: [[https://owasp.org/www-proj](https://owasp.org/www-proj)]([https://owasp.org/www-proj](https://owasp.org/www-proj)) ect-pytm/, accessed on 19 June 2023). It helps stakeholders to build a textual representation of a business setting or environment and to generate a DFD or a sequence diagram to highlight the most likely threats within the system. * Account and adapt to dynamic attack surface and third-party equipment that is in contact with MIoT over its life-cycle. * Employ and incorporate known and community-driven vulnerability catalogues and cyber intelligence feeds. * Enhance cyber security awareness and personnel training with regards to the latest cyber-attacks and threats to improve preparedness, tackle mitigations and pro-actively protect MIoT/IoT-based services and systems. * Better visualise attacks [101; 103] to understand threat actor's progression over IoT-based assets. Security is an all-encompassing problem faced by all organisations. With regard to managerial implications for the healthcare domain, we highlight the need for asset visibility, where SOC operators understand cyber-attack repercussions as they progress in the networks [90; 104; 105]. [PERSON] and [PERSON] (2022) [106] discuss IoT-based medical management systems and inherent open issues. Modern SOC should take multiple data feeds to provide context and to undermine cyber-attacks as they happen. Standard services implemented by SOC include event and incident management and response, dispatching teams to solve issues, user behaviour analytics, cyber threat intelligence, vulnerability management, and risk assessment. Nowadays, the trend is towards automating the processes of triaging multiple data for effective and timely analysis, tool integration, and adherence to regulation and guidance by established cyber security institutions (e.g., the US' NIST, the EU's ENISA, or the UK's NCSC). Security officers must orchestrate these systems to work together by performing relevant and timely risk assessments. There has been substantial research relating to DRA in isolation without considering its applicability to IoT. For instance, [PERSON] and [PERSON] (2019) [107] employed cyber threat intelligence (CTI) combined with DRA using so-called _semantic reasoners_ to enact realistic RA and to support decision-making. The approach used standardised intelligence specifications so that a broader community could participate in the security effort. Another example is provided by [PERSON] et al. (2022) [108]. They suggested performing DRA using modelling and simulation combined with systems theory, providing a systematic analysis approach for studying dynamic scenarios. An interesting study by [PERSON] et al. (2019) [26] focused on TM applied to smart home ecosystems. The authors identified information (user credentials, data collection, status information, logs, media, location, and PII) and physical assets (IoT devices, hubs, gateways, sensors/actuators, cloud servers).