# Challenges and Opportunities for Conducting Dynamic Risk Assessments in Medical IoT
## 2 Contextualisation
### MIoT Security and Privacy  
Recently, NIST/US published a draft version for Trusted IoT Device Network-Layer Onboarding and Lifecycle Management (NIST SP 1800-36) [64], showcasing how to tackle credentials to connect to networks securely (Link to NIST/US site: [[https://www.nccoe.nist.gov/projects/trus-ted-iot-device-network-layer-onboarding-and-lifecycle-management](https://www.nccoe.nist.gov/projects/trus-ted-iot-device-network-layer-onboarding-and-lifecycle-management)]([https://www.nccoe.nist.gov/projects/trus-ted-iot-device-network-layer-onboarding-and-lifecycle-management](https://www.nccoe.nist.gov/projects/trus-ted-iot-device-network-layer-onboarding-and-lifecycle-management)), accessed on 19 June 2023). One assumes that this document would be used alongside NIST's cybersecurity framework (NIST SP 800-37) (NIST Cybersecurity Framework: [[https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework)]([https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework)), accessed on 19 June 2023), a guide to help organisations seeking to improve cyber security risk management. In the same direction, the UK's National Cyber Security Centre (NCSC) publishes risk management guidance (NCSC Risk Management Guidance: [[https://www.ncsc.gov.uk/collecti-on/risk-management-collection](https://www.ncsc.gov.uk/collecti-on/risk-management-collection)]([https://www.ncsc.gov.uk/collecti-on/risk-management-collection](https://www.ncsc.gov.uk/collecti-on/risk-management-collection)), accessed on 19 June 2023), and the European Union Agency for Cybersecurity (ENISA/EU) has tackled risk management and assessment, providing tools and interoperability discussions among the many frameworks available to organisations (ENISA Risk Management and RA Framework: [[https://www.enisa.europa.eu/topics/threat-risk-management/current-risk/business-process-integration/the-enisa-rm-ra-framework](https://www.enisa.europa.eu/topics/threat-risk-management/current-risk/business-process-integration/the-enisa-rm-ra-framework)]([https://www.enisa.europa.eu/topics/threat-risk-management/current-risk/business-process-integration/the-enisa-rm-ra-framework](https://www.enisa.europa.eu/topics/threat-risk-management/current-risk/business-process-integration/the-enisa-rm-ra-framework)), accessed on 19 June 2023). [PERSON] et al. (2021) [57] suggested that MIoT has stricter security and privacy requirements in contrast to 'usual' IoT. The complex MIoT ecosystem presents a massive attack surface requiring constant monitoring, confidential communication among trusted parties, data integrity, resilience to attacks, auditing (for backtraces or forensics), access control, authentication, and privacy [16]. For healthcare settings located at home, these assurances must hold, preventing attacks, avoiding exposure, and thwarting attacks before they cascade to adjacent networks and systems. It is outside the scope of this work to list and comment on specific cyber-attacks on MIoT as there has been a host of research explaining these over the years [15; 27; 35; 62]. Complementing the MIoT ecosystem with cyber security counterparts, one could add the usual protections, i.e., intrusion detection systems (IDS), firewalls (and filtering scripts), encryption and access control (and varieties such as rule-based and attribute-based) as well as privacy-enhancing technologies, such as private information retrieval (PIR), virtual private networks (VPNs), transport layer security (TLS), combined with domain name system (DNS) SECurity extensions (DNSSEC). Nowadays, in the areas of IoT and trust mechanisms, there have been discussions on incorporating distributed ledger technologies (DLT) [65] or _blockchains_ to enact effective _chains of trust_ among multiple counterparts, objects and services in a decentralised manner [66; 67; 68]. [PERSON] et al. (2023) [69] have employed blockchain-based technologies in IoT to enable secure and reliable communications in smart cities.